• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 440
  • Last Modified:

Do subdomains need to contact each other, and why?

Hello everyone,

need help with the following:

We have several subdomains in my company's network, each in a remote location, each over IPsec vpn. Let's call my remote sites 1 and 2 and my central site HQ.

Everything is windows 2008 R2. Everything works fine (so far) except an error I see on event viewer. KCC tries to map the active directory topology, and it seems the domain controller from site 1 tries to connect to the DC in site 2, and it fails. Now, both of those sites are remote sites. Actually I DON'T want those 2 sites to be able to access each other.
I could fix this via firewalling and just letting the DC related traffic through, but do I really need this?

I did remove replication object between DCs in sites 1 and 2, however I get the following errors:

1925 (The attempt to establish a replication link for the following writable directory partition failed. )

and

1865 (The Knowledge Consistency Checker (KCC) was unable to form a complete spanning tree network topology. As a result, the following list of sites cannot be reached from the local site. )

and

1311 (There is insufficient site connectivity information for the KCC to create a spanning tree replication topology. Or, one or more directory servers with this directory partition are unable to replicate the directory partition information. This is probably due to inaccessible directory servers. )

So, can anyone suggest what I should do? Do I need to fix this and let the sites communicate, or can I simply bypass this somehow? What would be the effect?
0
Dimitris Ioakimoglou
Asked:
Dimitris Ioakimoglou
  • 4
  • 3
1 Solution
 
TI2HeavenCommented:
I am not sure but you probably are working with one realm (name in Kerberos for domain), and multiple sites. If you don’t want any replication at all you need 3 realms each in a different forest (name for Kerberos scope of trust relations).
But you probably don’t want that because users of any site will not be able to use resources of other site.
If users off site1 and site2 only use resources of HQ you will probably want to make site1 and site2 realms children of HQ realm (the root realm).
0
 
Dimitris IoakimoglouNetwork AdministratorAuthor Commented:
I'll search for a how-to and I'll get back to you on whether it solves my problem :)
0
 
TI2HeavenCommented:
OK. But please if you get stuck make another question so I may receive more points. This is a huge issue.
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 
Dimitris IoakimoglouNetwork AdministratorAuthor Commented:
Hm. Wouldn't a windows subdomain be considered a different realm in Kerberos terms? I think it would (from what I've been reading but I might be wrong of course), therefore I already use 3 distinct realms - since HQ is the parent windows domain and 1 and 2 are subdomains.

for example:

hq.local
1.hq.local
2.hq.local

are those not distinct realms?
0
 
TI2HeavenCommented:
You can map any number of DNS domains with just one realm (kerberos domain).
And you can map any number of realms with just one DNS domain.
The only restriction is that any Windows instance can only be member of one realm.
That is why I introduce you the term realm, to make a distinction between both terms.
The way a windows instance became a member of a realm is by asking the active directory. (The User Interface to make the request is in the system properties).
Told you is a huge issue ;-) !!!
0
 
Dimitris IoakimoglouNetwork AdministratorAuthor Commented:
Ok, points for you then. Looks like I can fix it your way.
0
 
TI2HeavenCommented:
I really appreciated your points and I don’t want you walk that long way by your own.
Let us help you in the design of the realms. Make an open question with your scenery.
I think you only need one realm but I can’t tell until you explain why replication is an issue.
For your answer I guess you are going to make 3 realms in 3 different forest; don’t do it until you have this open question answered.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now