Best practices on Active Directory site design

Posted on 2013-12-18
Medium Priority
Last Modified: 2014-01-16
Dear everyone,

I hope you all have a great festive season and great new year.

We are looking at determining what others do in terms of best practices for their AD sites.

Do you guys let the KCC handle your replication topology?

Do you guys configure site costs for each site link?

Any help greatly appreciated.
Question by:Simon336697
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
  • 2
  • +2
LVL 57

Accepted Solution

Mike Kline earned 800 total points
ID: 39727929
The vast majority let the KCC handle it, let that happen and monitor replication.  Mark has a great blog on it here


We have fast links so our sites replicate every 15 minutes. You can lookup "change notification" if you ant it faster.


LVL 70

Assisted Solution

KCTS earned 500 total points
ID: 39727969
KCC does a good job in the vast majority of cases. If it ain't broke......

Depends on your particular situation  but in most cases no need to cost site links either.
LVL 10

Assisted Solution

Zenvenky earned 200 total points
ID: 39728706
In addition to Mkline71's update make sure all AD related ports are in listening state at Firewall / router level. That way you can keep AD replication healthy.

AD Ports
Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 500 total points
ID: 39729370
As everyone has pointed out the KCC is your friend. In most cases you will use the KCC to create connection points for replicaiton. Keep in mind if you have any manually created connections they will be ignored by the KCC.

This can create issues if you have manually created connections. If the associating DC is in a down state The DC on the receiving end will "never" receive updates untile the hub DC is back online.

This is why the KCC si good to use becasue it polls the current replicaiton topology and keeps replication flowing. In the same scenario above if you had KCC auto connections created then the KCC would recongnize that the DC is down and it would find another replicating partner to continue replicaiton until the other DC comes back online (there is a timeout period for this 20 minutes i believe).

I would also suggest that you do the same for your bridge head servers in your sites. Do not use a "preferred" bridgehead server. The same concept applies, if your bridgehead server goes down updates will not be replicated to other sites. If you do not have a preferred bridgehead KCC will choose the bridgehead base on availability.

Also I would configure your "Inter-Site Transports" with 1 Site Link and adding all of the Sites to this Default Site link. You can break out and have multiple site links but this is not required if you have high speed links across all logical AD sites.

LVL 57

Expert Comment

by:Mike Kline
ID: 39729596
Just to follow up on brigeheads there is also improvements in 2008 R2 for workload distribution


Many smaller shops won't even notice it but this is a good improvement for larger ADs.



Author Comment

ID: 39730310
Hi guys.'thanks so much for you insight here.
Can I just verify - do you configure a site cost for each of your links?
We have a complex network topology - 3 main Datacenters globally  (hubs) with around 80 branch sites that radiate out from the hubs. We have a variety if link types and speeds. I thought that if you just left the site costs at the default, then the KCC is left to figure out the best path. My understanding was that you are better off mapping the physical topology to your site (logical) topology and in so doing, differentiate between sites that are slower (eg.slow link speeds) as opposed to faster.
You then assign a lower cost to the faster links so that they become the preferred path in case of failover for example. Is this flawed logic?
LVL 53

Expert Comment

by:Will Szymkowski
ID: 39730386
What you have stated above is correct. If you have slower links you can create new Site Links and provide a cost to them. The KCC takes those costs into consideration and creates the connections automatically. Atleast when you are using the KCC it will re-calculate if a DC is not reachable.

When designing AD structures I typically like to keep it as simplistic as possible. So that when you do run into replicaiton issues or delays etc, it is much easier to find and resolve the issue.

As for the physical to logical mapping, I would not recommend this model because the management of DC's can get out of hand if you have several physical sites. Example we have about 200 remote facilities and we have 10 logical AD sites. We have Site resiliancy in each site with multiple domain contorllers and have carved out subnets (physical sites)that are assocaited to AD Sites (logical).

Another reason why you would not want to have DC's at every site is a DC for a small office would be over kill. You can use a RO-DC but then you still have hardware and OS costs to take into account. This is where you can utilize Hub sites to authenticate etc.


Author Comment

ID: 39730436
Hi will.
Thanks so much for this.
We too do not put a DC at every physical location. We have most sites that are geographically located closest to one of 3 Datacenters (one in Europe, asiapac, Americas) added as a subnet to that Datacenters AD site, instead of creating an AD site for every physical branch location.
What I would love clarity on now is the following: this is what I'm recommending to our company.
1) Do not manually configure connection objects - let the KCC work this out
2) DO configure site costs for each site link.
Tier site links into 3 categories:
1/ fastest - Datacenter to datacenter site links - assign a site cost of 25
2/ medium - datacenter to mini hub site links - site cost of 50
3/ slowest - Datacenter to branch site links - site cost of 75
This will ensure that replication and AD traffic follows the optimum route.

Question. Will, does this look ok?
Will the KCC look at the configured site costs we assign, and abide by this, and can it reroute if this path is not reachable?
Do you see what we are trying to do, and is this worth the initial effort as opposed to not doing anything with sute cost (in this case, if all sute links have the same default site cost, then how can we be sure that the path the KCC has chosen is thr best route, and always that best route? wouldnt it be unpredictable?) and what ongoing effort is involved?

Author Comment

ID: 39787234
Thanks everyone and sorry for the delay.

Featured Post

Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Uncontrolled local administrators groups within any organization pose a huge security risk. Because these groups are locally managed it becomes difficult to audit and maintain them.
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…
Suggested Courses

718 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question