• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 4528
  • Last Modified:

Best practices on Active Directory site design

Dear everyone,

I hope you all have a great festive season and great new year.

We are looking at determining what others do in terms of best practices for their AD sites.

Do you guys let the KCC handle your replication topology?

Do you guys configure site costs for each site link?

Any help greatly appreciated.
0
Simon336697
Asked:
Simon336697
  • 3
  • 2
  • 2
  • +2
4 Solutions
 
Mike KlineCommented:
The vast majority let the KCC handle it, let that happen and monitor replication.  Mark has a great blog on it here

http://blogs.technet.com/b/markmoro/archive/2011/08/05/you-are-not-smarter-than-the-kcc.aspx

We have fast links so our sites replicate every 15 minutes. You can lookup "change notification" if you ant it faster.

Thanks

Mike
0
 
KCTSCommented:
KCC does a good job in the vast majority of cases. If it ain't broke......

Depends on your particular situation  but in most cases no need to cost site links either.
0
 
ZenVenkyArchitectCommented:
In addition to Mkline71's update make sure all AD related ports are in listening state at Firewall / router level. That way you can keep AD replication healthy.

AD Ports
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
Will SzymkowskiSenior Solution ArchitectCommented:
As everyone has pointed out the KCC is your friend. In most cases you will use the KCC to create connection points for replicaiton. Keep in mind if you have any manually created connections they will be ignored by the KCC.

This can create issues if you have manually created connections. If the associating DC is in a down state The DC on the receiving end will "never" receive updates untile the hub DC is back online.

This is why the KCC si good to use becasue it polls the current replicaiton topology and keeps replication flowing. In the same scenario above if you had KCC auto connections created then the KCC would recongnize that the DC is down and it would find another replicating partner to continue replicaiton until the other DC comes back online (there is a timeout period for this 20 minutes i believe).

I would also suggest that you do the same for your bridge head servers in your sites. Do not use a "preferred" bridgehead server. The same concept applies, if your bridgehead server goes down updates will not be replicated to other sites. If you do not have a preferred bridgehead KCC will choose the bridgehead base on availability.

Also I would configure your "Inter-Site Transports" with 1 Site Link and adding all of the Sites to this Default Site link. You can break out and have multiple site links but this is not required if you have high speed links across all logical AD sites.

Will.
0
 
Mike KlineCommented:
Just to follow up on brigeheads there is also improvements in 2008 R2 for workload distribution

http://technet.microsoft.com/en-us/library/bridgehead_server_selection(v=ws.10).aspx

Many smaller shops won't even notice it but this is a good improvement for larger ADs.

Thanks

Mike
0
 
Simon336697Author Commented:
Hi guys.'thanks so much for you insight here.
Can I just verify - do you configure a site cost for each of your links?
We have a complex network topology - 3 main Datacenters globally  (hubs) with around 80 branch sites that radiate out from the hubs. We have a variety if link types and speeds. I thought that if you just left the site costs at the default, then the KCC is left to figure out the best path. My understanding was that you are better off mapping the physical topology to your site (logical) topology and in so doing, differentiate between sites that are slower (eg.slow link speeds) as opposed to faster.
You then assign a lower cost to the faster links so that they become the preferred path in case of failover for example. Is this flawed logic?
0
 
Will SzymkowskiSenior Solution ArchitectCommented:
What you have stated above is correct. If you have slower links you can create new Site Links and provide a cost to them. The KCC takes those costs into consideration and creates the connections automatically. Atleast when you are using the KCC it will re-calculate if a DC is not reachable.

When designing AD structures I typically like to keep it as simplistic as possible. So that when you do run into replicaiton issues or delays etc, it is much easier to find and resolve the issue.

As for the physical to logical mapping, I would not recommend this model because the management of DC's can get out of hand if you have several physical sites. Example we have about 200 remote facilities and we have 10 logical AD sites. We have Site resiliancy in each site with multiple domain contorllers and have carved out subnets (physical sites)that are assocaited to AD Sites (logical).

Another reason why you would not want to have DC's at every site is a DC for a small office would be over kill. You can use a RO-DC but then you still have hardware and OS costs to take into account. This is where you can utilize Hub sites to authenticate etc.

Will.
0
 
Simon336697Author Commented:
Hi will.
Thanks so much for this.
We too do not put a DC at every physical location. We have most sites that are geographically located closest to one of 3 Datacenters (one in Europe, asiapac, Americas) added as a subnet to that Datacenters AD site, instead of creating an AD site for every physical branch location.
What I would love clarity on now is the following: this is what I'm recommending to our company.
1) Do not manually configure connection objects - let the KCC work this out
2) DO configure site costs for each site link.
Tier site links into 3 categories:
1/ fastest - Datacenter to datacenter site links - assign a site cost of 25
2/ medium - datacenter to mini hub site links - site cost of 50
3/ slowest - Datacenter to branch site links - site cost of 75
This will ensure that replication and AD traffic follows the optimum route.

Question. Will, does this look ok?
Will the KCC look at the configured site costs we assign, and abide by this, and can it reroute if this path is not reachable?
Do you see what we are trying to do, and is this worth the initial effort as opposed to not doing anything with sute cost (in this case, if all sute links have the same default site cost, then how can we be sure that the path the KCC has chosen is thr best route, and always that best route? wouldnt it be unpredictable?) and what ongoing effort is involved?
0
 
Simon336697Author Commented:
Thanks everyone and sorry for the delay.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Get 10% Off Your First Squarespace Website

Ready to showcase your work, publish content or promote your business online? With Squarespace’s award-winning templates and 24/7 customer service, getting started is simple. Head to Squarespace.com and use offer code ‘EXPERTS’ to get 10% off your first purchase.

  • 3
  • 2
  • 2
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now