Solved

Best practices on Active Directory site design

Posted on 2013-12-18
9
3,238 Views
Last Modified: 2014-01-16
Dear everyone,

I hope you all have a great festive season and great new year.

We are looking at determining what others do in terms of best practices for their AD sites.

Do you guys let the KCC handle your replication topology?

Do you guys configure site costs for each site link?

Any help greatly appreciated.
0
Comment
Question by:Simon336697
  • 3
  • 2
  • 2
  • +2
9 Comments
 
LVL 57

Accepted Solution

by:
Mike Kline earned 200 total points
ID: 39727929
The vast majority let the KCC handle it, let that happen and monitor replication.  Mark has a great blog on it here

http://blogs.technet.com/b/markmoro/archive/2011/08/05/you-are-not-smarter-than-the-kcc.aspx

We have fast links so our sites replicate every 15 minutes. You can lookup "change notification" if you ant it faster.

Thanks

Mike
0
 
LVL 70

Assisted Solution

by:KCTS
KCTS earned 125 total points
ID: 39727969
KCC does a good job in the vast majority of cases. If it ain't broke......

Depends on your particular situation  but in most cases no need to cost site links either.
0
 
LVL 9

Assisted Solution

by:Zenvenky
Zenvenky earned 50 total points
ID: 39728706
In addition to Mkline71's update make sure all AD related ports are in listening state at Firewall / router level. That way you can keep AD replication healthy.

AD Ports
0
 
LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 125 total points
ID: 39729370
As everyone has pointed out the KCC is your friend. In most cases you will use the KCC to create connection points for replicaiton. Keep in mind if you have any manually created connections they will be ignored by the KCC.

This can create issues if you have manually created connections. If the associating DC is in a down state The DC on the receiving end will "never" receive updates untile the hub DC is back online.

This is why the KCC si good to use becasue it polls the current replicaiton topology and keeps replication flowing. In the same scenario above if you had KCC auto connections created then the KCC would recongnize that the DC is down and it would find another replicating partner to continue replicaiton until the other DC comes back online (there is a timeout period for this 20 minutes i believe).

I would also suggest that you do the same for your bridge head servers in your sites. Do not use a "preferred" bridgehead server. The same concept applies, if your bridgehead server goes down updates will not be replicated to other sites. If you do not have a preferred bridgehead KCC will choose the bridgehead base on availability.

Also I would configure your "Inter-Site Transports" with 1 Site Link and adding all of the Sites to this Default Site link. You can break out and have multiple site links but this is not required if you have high speed links across all logical AD sites.

Will.
0
Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

 
LVL 57

Expert Comment

by:Mike Kline
ID: 39729596
Just to follow up on brigeheads there is also improvements in 2008 R2 for workload distribution

http://technet.microsoft.com/en-us/library/bridgehead_server_selection(v=ws.10).aspx

Many smaller shops won't even notice it but this is a good improvement for larger ADs.

Thanks

Mike
0
 
LVL 1

Author Comment

by:Simon336697
ID: 39730310
Hi guys.'thanks so much for you insight here.
Can I just verify - do you configure a site cost for each of your links?
We have a complex network topology - 3 main Datacenters globally  (hubs) with around 80 branch sites that radiate out from the hubs. We have a variety if link types and speeds. I thought that if you just left the site costs at the default, then the KCC is left to figure out the best path. My understanding was that you are better off mapping the physical topology to your site (logical) topology and in so doing, differentiate between sites that are slower (eg.slow link speeds) as opposed to faster.
You then assign a lower cost to the faster links so that they become the preferred path in case of failover for example. Is this flawed logic?
0
 
LVL 53

Expert Comment

by:Will Szymkowski
ID: 39730386
What you have stated above is correct. If you have slower links you can create new Site Links and provide a cost to them. The KCC takes those costs into consideration and creates the connections automatically. Atleast when you are using the KCC it will re-calculate if a DC is not reachable.

When designing AD structures I typically like to keep it as simplistic as possible. So that when you do run into replicaiton issues or delays etc, it is much easier to find and resolve the issue.

As for the physical to logical mapping, I would not recommend this model because the management of DC's can get out of hand if you have several physical sites. Example we have about 200 remote facilities and we have 10 logical AD sites. We have Site resiliancy in each site with multiple domain contorllers and have carved out subnets (physical sites)that are assocaited to AD Sites (logical).

Another reason why you would not want to have DC's at every site is a DC for a small office would be over kill. You can use a RO-DC but then you still have hardware and OS costs to take into account. This is where you can utilize Hub sites to authenticate etc.

Will.
0
 
LVL 1

Author Comment

by:Simon336697
ID: 39730436
Hi will.
Thanks so much for this.
We too do not put a DC at every physical location. We have most sites that are geographically located closest to one of 3 Datacenters (one in Europe, asiapac, Americas) added as a subnet to that Datacenters AD site, instead of creating an AD site for every physical branch location.
What I would love clarity on now is the following: this is what I'm recommending to our company.
1) Do not manually configure connection objects - let the KCC work this out
2) DO configure site costs for each site link.
Tier site links into 3 categories:
1/ fastest - Datacenter to datacenter site links - assign a site cost of 25
2/ medium - datacenter to mini hub site links - site cost of 50
3/ slowest - Datacenter to branch site links - site cost of 75
This will ensure that replication and AD traffic follows the optimum route.

Question. Will, does this look ok?
Will the KCC look at the configured site costs we assign, and abide by this, and can it reroute if this path is not reachable?
Do you see what we are trying to do, and is this worth the initial effort as opposed to not doing anything with sute cost (in this case, if all sute links have the same default site cost, then how can we be sure that the path the KCC has chosen is thr best route, and always that best route? wouldnt it be unpredictable?) and what ongoing effort is involved?
0
 
LVL 1

Author Comment

by:Simon336697
ID: 39787234
Thanks everyone and sorry for the delay.
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now