Best practices on Active Directory site design

Dear everyone,

I hope you all have a great festive season and great new year.

We are looking at determining what others do in terms of best practices for their AD sites.

Do you guys let the KCC handle your replication topology?

Do you guys configure site costs for each site link?

Any help greatly appreciated.
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

Mike KlineConnect With a Mentor Commented:
The vast majority let the KCC handle it, let that happen and monitor replication.  Mark has a great blog on it here

We have fast links so our sites replicate every 15 minutes. You can lookup "change notification" if you ant it faster.


KCTSConnect With a Mentor Commented:
KCC does a good job in the vast majority of cases. If it ain't broke......

Depends on your particular situation  but in most cases no need to cost site links either.
ZenVenkyConnect With a Mentor ArchitectCommented:
In addition to Mkline71's update make sure all AD related ports are in listening state at Firewall / router level. That way you can keep AD replication healthy.

AD Ports
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Will SzymkowskiConnect With a Mentor Senior Solution ArchitectCommented:
As everyone has pointed out the KCC is your friend. In most cases you will use the KCC to create connection points for replicaiton. Keep in mind if you have any manually created connections they will be ignored by the KCC.

This can create issues if you have manually created connections. If the associating DC is in a down state The DC on the receiving end will "never" receive updates untile the hub DC is back online.

This is why the KCC si good to use becasue it polls the current replicaiton topology and keeps replication flowing. In the same scenario above if you had KCC auto connections created then the KCC would recongnize that the DC is down and it would find another replicating partner to continue replicaiton until the other DC comes back online (there is a timeout period for this 20 minutes i believe).

I would also suggest that you do the same for your bridge head servers in your sites. Do not use a "preferred" bridgehead server. The same concept applies, if your bridgehead server goes down updates will not be replicated to other sites. If you do not have a preferred bridgehead KCC will choose the bridgehead base on availability.

Also I would configure your "Inter-Site Transports" with 1 Site Link and adding all of the Sites to this Default Site link. You can break out and have multiple site links but this is not required if you have high speed links across all logical AD sites.

Mike KlineCommented:
Just to follow up on brigeheads there is also improvements in 2008 R2 for workload distribution

Many smaller shops won't even notice it but this is a good improvement for larger ADs.


Simon336697Author Commented:
Hi guys.'thanks so much for you insight here.
Can I just verify - do you configure a site cost for each of your links?
We have a complex network topology - 3 main Datacenters globally  (hubs) with around 80 branch sites that radiate out from the hubs. We have a variety if link types and speeds. I thought that if you just left the site costs at the default, then the KCC is left to figure out the best path. My understanding was that you are better off mapping the physical topology to your site (logical) topology and in so doing, differentiate between sites that are slower (eg.slow link speeds) as opposed to faster.
You then assign a lower cost to the faster links so that they become the preferred path in case of failover for example. Is this flawed logic?
Will SzymkowskiSenior Solution ArchitectCommented:
What you have stated above is correct. If you have slower links you can create new Site Links and provide a cost to them. The KCC takes those costs into consideration and creates the connections automatically. Atleast when you are using the KCC it will re-calculate if a DC is not reachable.

When designing AD structures I typically like to keep it as simplistic as possible. So that when you do run into replicaiton issues or delays etc, it is much easier to find and resolve the issue.

As for the physical to logical mapping, I would not recommend this model because the management of DC's can get out of hand if you have several physical sites. Example we have about 200 remote facilities and we have 10 logical AD sites. We have Site resiliancy in each site with multiple domain contorllers and have carved out subnets (physical sites)that are assocaited to AD Sites (logical).

Another reason why you would not want to have DC's at every site is a DC for a small office would be over kill. You can use a RO-DC but then you still have hardware and OS costs to take into account. This is where you can utilize Hub sites to authenticate etc.

Simon336697Author Commented:
Hi will.
Thanks so much for this.
We too do not put a DC at every physical location. We have most sites that are geographically located closest to one of 3 Datacenters (one in Europe, asiapac, Americas) added as a subnet to that Datacenters AD site, instead of creating an AD site for every physical branch location.
What I would love clarity on now is the following: this is what I'm recommending to our company.
1) Do not manually configure connection objects - let the KCC work this out
2) DO configure site costs for each site link.
Tier site links into 3 categories:
1/ fastest - Datacenter to datacenter site links - assign a site cost of 25
2/ medium - datacenter to mini hub site links - site cost of 50
3/ slowest - Datacenter to branch site links - site cost of 75
This will ensure that replication and AD traffic follows the optimum route.

Question. Will, does this look ok?
Will the KCC look at the configured site costs we assign, and abide by this, and can it reroute if this path is not reachable?
Do you see what we are trying to do, and is this worth the initial effort as opposed to not doing anything with sute cost (in this case, if all sute links have the same default site cost, then how can we be sure that the path the KCC has chosen is thr best route, and always that best route? wouldnt it be unpredictable?) and what ongoing effort is involved?
Simon336697Author Commented:
Thanks everyone and sorry for the delay.
All Courses

From novice to tech pro — start learning today.