Best practices on Active Directory site design

Posted on 2013-12-18
Last Modified: 2014-01-16
Dear everyone,

I hope you all have a great festive season and great new year.

We are looking at determining what others do in terms of best practices for their AD sites.

Do you guys let the KCC handle your replication topology?

Do you guys configure site costs for each site link?

Any help greatly appreciated.
Question by:Simon336697
  • 3
  • 2
  • 2
  • +2
LVL 57

Accepted Solution

Mike Kline earned 200 total points
ID: 39727929
The vast majority let the KCC handle it, let that happen and monitor replication.  Mark has a great blog on it here

We have fast links so our sites replicate every 15 minutes. You can lookup "change notification" if you ant it faster.


LVL 70

Assisted Solution

KCTS earned 125 total points
ID: 39727969
KCC does a good job in the vast majority of cases. If it ain't broke......

Depends on your particular situation  but in most cases no need to cost site links either.

Assisted Solution

Zenvenky earned 50 total points
ID: 39728706
In addition to Mkline71's update make sure all AD related ports are in listening state at Firewall / router level. That way you can keep AD replication healthy.

AD Ports
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 125 total points
ID: 39729370
As everyone has pointed out the KCC is your friend. In most cases you will use the KCC to create connection points for replicaiton. Keep in mind if you have any manually created connections they will be ignored by the KCC.

This can create issues if you have manually created connections. If the associating DC is in a down state The DC on the receiving end will "never" receive updates untile the hub DC is back online.

This is why the KCC si good to use becasue it polls the current replicaiton topology and keeps replication flowing. In the same scenario above if you had KCC auto connections created then the KCC would recongnize that the DC is down and it would find another replicating partner to continue replicaiton until the other DC comes back online (there is a timeout period for this 20 minutes i believe).

I would also suggest that you do the same for your bridge head servers in your sites. Do not use a "preferred" bridgehead server. The same concept applies, if your bridgehead server goes down updates will not be replicated to other sites. If you do not have a preferred bridgehead KCC will choose the bridgehead base on availability.

Also I would configure your "Inter-Site Transports" with 1 Site Link and adding all of the Sites to this Default Site link. You can break out and have multiple site links but this is not required if you have high speed links across all logical AD sites.

LVL 57

Expert Comment

by:Mike Kline
ID: 39729596
Just to follow up on brigeheads there is also improvements in 2008 R2 for workload distribution

Many smaller shops won't even notice it but this is a good improvement for larger ADs.



Author Comment

ID: 39730310
Hi guys.'thanks so much for you insight here.
Can I just verify - do you configure a site cost for each of your links?
We have a complex network topology - 3 main Datacenters globally  (hubs) with around 80 branch sites that radiate out from the hubs. We have a variety if link types and speeds. I thought that if you just left the site costs at the default, then the KCC is left to figure out the best path. My understanding was that you are better off mapping the physical topology to your site (logical) topology and in so doing, differentiate between sites that are slower (eg.slow link speeds) as opposed to faster.
You then assign a lower cost to the faster links so that they become the preferred path in case of failover for example. Is this flawed logic?
LVL 53

Expert Comment

by:Will Szymkowski
ID: 39730386
What you have stated above is correct. If you have slower links you can create new Site Links and provide a cost to them. The KCC takes those costs into consideration and creates the connections automatically. Atleast when you are using the KCC it will re-calculate if a DC is not reachable.

When designing AD structures I typically like to keep it as simplistic as possible. So that when you do run into replicaiton issues or delays etc, it is much easier to find and resolve the issue.

As for the physical to logical mapping, I would not recommend this model because the management of DC's can get out of hand if you have several physical sites. Example we have about 200 remote facilities and we have 10 logical AD sites. We have Site resiliancy in each site with multiple domain contorllers and have carved out subnets (physical sites)that are assocaited to AD Sites (logical).

Another reason why you would not want to have DC's at every site is a DC for a small office would be over kill. You can use a RO-DC but then you still have hardware and OS costs to take into account. This is where you can utilize Hub sites to authenticate etc.


Author Comment

ID: 39730436
Hi will.
Thanks so much for this.
We too do not put a DC at every physical location. We have most sites that are geographically located closest to one of 3 Datacenters (one in Europe, asiapac, Americas) added as a subnet to that Datacenters AD site, instead of creating an AD site for every physical branch location.
What I would love clarity on now is the following: this is what I'm recommending to our company.
1) Do not manually configure connection objects - let the KCC work this out
2) DO configure site costs for each site link.
Tier site links into 3 categories:
1/ fastest - Datacenter to datacenter site links - assign a site cost of 25
2/ medium - datacenter to mini hub site links - site cost of 50
3/ slowest - Datacenter to branch site links - site cost of 75
This will ensure that replication and AD traffic follows the optimum route.

Question. Will, does this look ok?
Will the KCC look at the configured site costs we assign, and abide by this, and can it reroute if this path is not reachable?
Do you see what we are trying to do, and is this worth the initial effort as opposed to not doing anything with sute cost (in this case, if all sute links have the same default site cost, then how can we be sure that the path the KCC has chosen is thr best route, and always that best route? wouldnt it be unpredictable?) and what ongoing effort is involved?

Author Comment

ID: 39787234
Thanks everyone and sorry for the delay.

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
JRNL_WRAP_ERROR issue in sysvol 20 34
ticket bloat 3 31
Existing Office 365 implement on-premise AD 4 45
Enterprise Mode 4 30
Is your Office 365 signature not working the way you want it to? Are signature updates taking up too much of your time? Let's run through the most common problems that an IT administrator can encounter when dealing with Office 365 email signatures.
This script can help you clean up your user profile database by comparing profiles to Active Directory users in a particular OU, and removing the profiles that don't match.
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

821 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question