1. Implementing Active Directory Domain Services Sites and Replication
Presentation: 50 minutes
After completing this module, the students will be able to:
Describe how Active Directory® Domain Services (AD DS) replication works.
Explain how to configure AD DS sites to help optimize authentication and replication traffic.
Explain how to configure and monitor AD DS replication.
Required materials
To teach this module, you need the Microsoft® Office PowerPoint® file 20412C_MVA_05.pptx.
Important:
We recommend that you use PowerPoint 2007 or newer to display the slides for this course. If you use PowerPoint Viewer or an older version of Office PowerPoint, the slides might not display correctly.
Preparation Tasks
To prepare for this module:
Read all of the materials for this module.
Practice performing the demonstrations.
Preparation for demonstrations
For this module, you will use the available virtual machine environment. Before you begin the module, you must complete the following steps:
On the host computer, click Start, point to Administrative Tools, and then click Hyper‑V Manager.
In Hyper‑V Manager, click 20412C‑LON‑DC1, and in the Actions pane, click Start.
In the Actions pane, click Connect. Wait until the virtual machine starts.
Sign in using the following credentials:
User name: Adatum\Administrator
Password: Pa$$w0rd
Repeat steps 2 through 4 for 20412C-TOR-DC1.
Note: When you are done with demonstrations in this module, revert all virtual machines to their initial checkpoint.
Module 5
Implementing Active Directory Domain Services Sites and Replication
(More notes on the next slide)

2. Configuring and Monitoring AD DS Replication
Module Overview
5: Implementing Active Directory Domain Services Sites and Replication
Configuring and Monitoring AD DS Replication
Introduce this module by stressing how important it is that an enterprise utilizes multiple domain controllers within AD DS. This concept provides a natural segue to a discussion regarding how important it is that administrators understand replication and how it works.
Discuss what would happen if information does not replicate consistently to all domain controllers. For example, if a user creates a user object on one domain controller, but that information does not replicate to all other domain controllers, the user will be able to authenticate only to the domain controller in which the account was created. This could result in a random experience of logon success and failures.
Point out that multiple sites enable an enterprise’s administrator to control replication with the added benefit of providing a way to provide efficient authentication and local access to site-aware resources.

3. AD DS Replication Overview

4. Lesson 1: AD DS Replication Overview
5: Implementing Active Directory Domain Services Sites and Replication
How SYSVOL Replication Works
Briefly describe the topics in this lesson. This content has changed little since earlier versions of Windows® operating systems, so if your students have previous experience with AD DS replication, you can summarize the information in these topics instead of going into detailed conversation about the topic content.

5. Characteristics of AD DS Replication
5: Implementing Active Directory Domain Services Sites and Replication
Key characteristics of Active Directory replication include:
Multimaster replication
Pull replication
Store-and-forward
Partitions
Automatic generation of an efficient, robust replication topology
Attribute-level and multi-value replication
Distinct control of intrasite and intersite replication
Collision detection and remediation
Discuss the replication model. It is important that the students understand that they can make changes from any domain controller in the domain, except for read-only domain controllers (RODCs), and that those changes then replicate to all other domain controllers. Compare this with a single master replication model, where you make changes on one domain controller only.
Discuss what benefits and disadvantages result from using a multimaster replication model. Stress that this model results in a more complicated replication process than the single master model, but it provides more redundancy and scalability.
Use that as a transition to introduce the concepts of integrity, convergence, and performance. In a multimaster database, these must be balanced.
Go on to define the key design characteristics of AD DS replication, which the slide shows.

6. How AD DS Replication Works Within a Site
5: Implementing Active Directory Domain Services Sites and Replication
Intrasite replication uses:
Connection objects for inbound replication to a domain controller
KCC to automatically create topology
Efficient (maximum three-hop) and robust (two-way) topology
Notifications in which the domain controller tells its downstream partners that a change is available
Polling, in which the domain controller checks with its upstream partners for changes
Downstream domain controller directory replication agent replicates changes
Changes to all partitions held by both domain controllers are replicated
Use this slide to explain how AD DS replication works within a site. Discuss, demonstrate, or illustrate the role of the knowledge consistency checker (KCC) in creating connection objects to create an efficient (three-hop maximum) and robust (two-way) topology.
Emphasize that there are few reasons to create connection objects manually within a site. In fact, administrators have very few options by which they can modify the replication topology within a site.
Then, move on to the replication itself. Mention that within a single site, the replication goal is to update all domain controllers as quickly as possible.
However, when a change is made on a domain controller, the domain controller waits as long as 15 seconds to notify its partners of the change. This increases the efficiency of replication if additional changes are made to the partition.
Point out that with a maximum of 15 seconds, this means that on average, changes replicate every 7.5 seconds. A maximum of three hops means that within 45 seconds (22.5 seconds on average), the entire site is updated with a change.
Introduce the directory replication agent.
Point out that all partitions that are replicated between two domain controllers on a connection object are replicated simultaneously. There is no way to time the partitions differently.
Point out that replication traffic is not compressed, because it is assumed that all domain controllers in the same site will be connected with a fast network connection with abundant available bandwidth.
DC01
DC02
DC03

7. Resolving Replication Conflicts
5: Implementing Active Directory Domain Services Sites and Replication
In multimaster replication models, replication conflicts arise when:
The same attribute is changed on two domain controllers simultaneously
An object is moved or added to a deleted container on another domain controller
Two objects with the same relative distinguished name are added to the same container on two different domain controllers
To resolve replication conflicts, AD DS uses:
Version number
Time stamp
Server GUID
Highlight that replication conflicts are not likely to be an issue in most organizations that have a managed AD DS change-control process. In most organizations, only one group is likely to make changes to the same objects in AD DS, and that group should have a communication process that ensures that conflicting changes do not happen.
If the students are interested in more detail about how AD DS resolves replication conflicts, draw a diagram of several domain controllers and show how attribute numbers, time stamps, and server GUIDs always result in a conflict resolution.

8. How Replication Topology Is Generated
Global
Catalog
Server A1 A2 B2 B2
Domain B topology
Schema and configuration topology
Global catalog replication B1 B1
Domain
Controllers in Another
Global
Catalog
Server A3 A3 A4 A4
Global
Catalog
Server B3 B3
Domain A topology

9. How RODC Replication Works
5: Implementing Active Directory Domain Services Sites and Replication
When an RODC is implemented:
The KCC detects that it is an RODC and creates one-way only connection objects (black) from one or more source domain controllers
Write referrals are sent to the source domain controllers from the RODC (blue)
An RODC performs Replicate Single Object inbound replication during:
Password changes
DNS updates to a writable DNS server
Updates to various client attributes
Begin this topic by explaining the benefits of an RODC. Stress that an RODC only has inbound connection objects so that it can replicate changes from writable domain controllers and that only replicated changes are allowed. Since RODCs are read-only, outbound connection objects are not necessary. RODCs are for scenarios with lower physical security that may get compromised. One security benefit is that RODCs never replicate information out.
Mention that there are some attributes that are never replicated to an RODC, such as Windows BitLocker® Drive Encryption, and recovery keys, and that client applications must be aware to request them from full domain controllers specifically because the RODC would always return empty values.
Mention scenarios in which changes may be made to a RODC. For example, if a malicious user gains physical access to the domain controller, the attacker may be able to make changes to the Active Directory database. However, with a RODC in place, these changes will not be replicated to any other domain controller.
Mention that with an RODC, a single connection object is created, but only from the writeable domain controller to the RODC.
RODC
Source Domain Controllers

10. How SYSVOL Replication Works
5: Implementing Active Directory Domain Services Sites and Replication
SYSVOL contains logon scripts, Group Policy templates, and GPOs with their content
SYSVOL replication can take place using:
FRS, which is primarily used in Windows Server 2003 and older domain structures
DFS Replication, which is used in Windows Server 2008 and newer domains
To migrate SYSVOL replication from the FRS to DFS Replication:
The domain functional level must be at least Windows Server 2008
Use the Dfsrmig.exe tool to perform the migration
Explain that it is critical that SYSVOL is synchronized between all domain controllers within a domain.
Describe the benefits of using Distributed File System (DFS) Replication instead of the File Replication Service (FRS) for replication processes.

11. Configuring AD DS Sites

12. Lesson 2: Configuring AD DS Sites
5: Implementing Active Directory Domain Services Sites and Replication
How Client Computers Locate Domain Controllers Within Sites
Briefly describe the lesson content. Ask the students if their organizations include multiple locations, and if so, the types of services that those remote locations provide, such as domain controller authentication.

13. Sites are associated with subnet objects Sites are used to manage:
What Are AD DS Sites?
5: Implementing Active Directory Domain Services Sites and Replication
Sites identify network locations with fast, reliable network connections
Sites are associated with subnet objects
Sites are used to manage:
Replication when domain controllers separated by slow, expensive links
Service localization:
Domain controller authentication (LDAP and Kerberos)
Active Directory-aware (site aware) services or applications
Provide the highest-level definition of a site: an object that supports replication and service localization. Stress the importance of maintaining subnet object-to-site mapping.
Mention that when you install AD DS, a default site named Default-First-Site-Name is created. All computers, including domain controllers, are added automatically to the default site until you create additional sites.
Mention that the incorrect site implementation can cause problems later–for example, logon traffic over wide area network (WAN) links. Also, mention that recent versions of Microsoft Exchange Server use Active Directory sites to route . Mention that subnets that are assigned to virtual private network (VPN) technologies such as direct access need to be configured in Active Directory Sites and Services to prevent users from logging onto a VPN gateway in one location and then receiving Group Policy Objects (GPOs) from another location over a WAN connection. A1 A2
Site
IP Subnets

14. Why Implement Additional Sites?
20412C
Why Implement Additional Sites?
5: Implementing Active Directory Domain Services Sites and Replication
Create additional sites when:
A part of the network is separated by a slow link
A part of the network has enough users to warrant hosting domain controllers or other services in that location
You want to control service localization
You want to control replication between domain controllers
Explain that a location can contain more than one Active Directory site, or an Active Directory site may span more than one location.
An important takeaway for this topic is that the students should be able answer the question, “Would I want a separate site for this location?”
Site A2 A3 A1
IP Subnets

15. Demonstration: Configuring AD DS Sites
5: Implementing Active Directory Domain Services Sites and Replication
In this demonstration, you will see how to configure AD DS sites
Demonstrate or discuss the most basic procedures for creating a site and assigning a subnet to the site.
Mention that many of these tasks require credentials provided by the Enterprise Admin or Domain Admin of the root domain, by default, but that you can delegate them.
Mention to the students that the default site link, DEFAULTIPSITELINK, will be the only site link available until you create additional site links.
Preparation Steps
To complete this demonstration, you must ensure that the 20412C-LON-DC1 and the 20412C-TOR-DC1 virtual machines are running. Sign in on all virtual machines as Adatum\Administrator with the password Pa$$w0rd.
Note: To complete this and subsequent demonstrations, you need to configure TOR-DC1 as a domain controller, by performing following steps:
On TOR-DC1, in the Server Manager, click Manage, and from the drop-down list box, click Add Roles and Features.
On the Before You Begin page, click Next.
On the Select installation type page, confirm that Role-based or feature-based installation is selected, and then click Next.
On the Select destination server page, ensure that Select a server from the server pool is selected, and that TOR-DC1.adatum.com is highlighted, and then click Next.
On the Select server roles page, click Active Directory Domain Services.
On the Add features that are required for Active Directory Domain Services? page, click Add Features, and then click Next.
On the Select features page, click Next.
On the Active Directory Domain Services page, click Next.
On the Confirm installation selections page, click Install. (This may take a few minutes to complete.)
When the AD DS binaries have installed, do not click Close, but click the blue Promote this server to a domain controller link.
In the Deployment Configuration window, click Add a domain controller to an existing domain, and then click Next.
In the Domain Controller Options window, ensure that both the Domain Name system (DNS) server and Global Catalog (GC) check boxes are selected.
Confirm that Site name: is set to Default-First-Site-Name, and then under Type the Directory Services Restore Mode (DSRM) password, type Pa$$w0rd in both the Password and Confirm password boxes. Click Next.
On the DNS Options page, click Next.
In the Additional Options page, click Next.
In the Paths window, click Next.
In the Review Options window, click Next.
In the Prerequisites Check window, confirm that there are no issues, and then click Install. The server will restart automatically.
After TOR-DC1 restarts, sign in as Adatum\Administrator with the password Pa$$w0rd.
Demonstration Steps
On LON-DC1, in the Server Manager, click Tools, and then click Active Directory Sites and Services.
In Active Directory Sites and Services, expand Sites, and then click Default-First-Site-Name.
Right-click Default-First-Site-Name, and then click Rename.
Type LondonHQ, and then press Enter.
In the navigation pane, right-click Sites, and then click New Site.
In the New Object – Site dialog box, in the Name text box, type Toronto.
Select DEFAULTIPSITELINK, and then click OK.
In the Active Directory Domain Services dialog box, click OK.
In the navigation pane, right-click Subnets, and then click New Subnet.
In the New Object – Subnet dialog box, in the Prefix text box, type /24.
Under Select a site object for this prefix, click LondonHQ, and then click OK.
In the New Object – Subnet dialog box, in the Prefix text box, type /24.
Under Select a site object for this prefix, click Toronto, and then click OK.
In the navigation pane, expand LondonHQ, and then expand Servers.
Right-click TOR-DC1, and then click Move.
In the Move Server dialog box, select Toronto, and then click OK.
In the navigation pane, expand Toronto, and then expand Servers.
Verify that TOR-DC1 is now located in the Toronto Site.
(More notes on the next slide)

16. How Replication Works Between Sites
5: Implementing Active Directory Domain Services Sites and Replication A2
Replication
IP Subnets A1 B1 B2
Replication within sites:
Assumes fast, inexpensive, and highly reliable network links
Does not compress traffic
Uses a change notification mechanism
Replication between sites:
Assumes higher cost, limited bandwidth, and unreliable network links
Has the ability to compress replication
Occurs on a configured schedule
Can be configured for immediate and urgent replications
Mention that creating sites is a primary means by which you can manage replication traffic across slow network connections. Replication between sites may be compressed, and you may configure a replication schedule.
Mention that urgent changes, such as password changes, replicate between sites immediately, and are not based on the replication schedule. Describe the difference between urgent and immediate replication.

17. What Is the Intersite Topology Generator?
20412C
What Is the Intersite Topology Generator?
5: Implementing Active Directory Domain Services Sites and Replication
ISTG defines the replication between AD DS sites on a network
ISTG
Mention that the intersite topology generator (ISTG) creates the replication topology between sites. The ISTG uses the KCC, but also adds an additional level of complexity when managing multiple sites.
The ISTG is an Active Directory process that defines replication between sites on a network. AD DS automatically designates a single domain controller in each site to act as the ISTG. Because this action occurs automatically, you do not have to perform any action to determine the replication topology and bridgehead server roles.
Replication
IP Subnets
Replication
Site Link
ISTG
IP Subnets

18. Optimizing Domain Controller Coverage in Multiple Site Scenarios
5: Implementing Active Directory Domain Services Sites and Replication
Domain controllers register SRV records as follows:
_tcp.adatum.com: All domain controllers in the domain
_tcp.sitename._sites.adatum.com: All services in a specific site
Clients query DNS to locate services in specific sites
Discuss how service (SRV) resource records help AD DS clients locate services on the network. Focus in detail on how sites play a role in this service location process.
Consider showing an example using DNS Manager.
Explain the situations where a RODC might be used for a site, or even if domain controllers should be placed in every site.

19. How Client Computers Locate Domain Controllers Within Sites
5: Implementing Active Directory Domain Services Sites and Replication
The process for locating a domain controller occurs as follows:
New client queries for all domain controllers in the domain
Client attempts LDAP ping to find all domain controllers
First domain controller responds
Client queries for all domain controllers in the site
Client attempts LDAP ping to find all domain controllers in the site
Client stores domain controller and site name for further use
Domain controller is used for the full logon process, including authentication, building the token, and building the list of GPOs to apply
Domain controller offline? Client queries for domain controllers in registry stored site
Client moved to another site? Domain controller refers client to another site
Use this topic to describe how a client locates a domain controller. Be sure to discuss how you can use sites to find the domain controller and service location, and what happens when a client moves to another site.

20. Configuring and Monitoring AD DS Replication

21. Lesson 3: Configuring and Monitoring AD DS Replication
5: Implementing Active Directory Domain Services Sites and Replication
Tools for Monitoring and Managing Replication
Briefly describe the lesson content.

22. What Are AD DS Site Links?
20412C
What Are AD DS Site Links?
5: Implementing Active Directory Domain Services Sites and Replication
Site links contain sites:
Within a site link, a connection object can be created between any two domain controllers
The default site link, DEFAULTIPSITELINK, is not always appropriate given your network topology
Point out that even with multiple sites that have a distinct hub-and-spoke network topology, all routers go through the headquarters. If AD DS has the sites on one site link, it may also create connection objects between domain controllers in the spokes.
To align your network topology with Active Directory replication, you must create specific site links and ensure that the DEFAULTIPSITELINK is not used. Additionally, you must turn off site link bridging, which the next topic discusses.
This is not a design class, so discuss the subject matter at a level that allows the students to understand why the tasks are done, but does not delve too deeply into design concepts.
SEA
AMS
Beijing HQ
HQ-SEA
Site Link
DEFAULTIPSITELINK

23. What Is Site Link Bridging?
20412C
What Is Site Link Bridging?
5: Implementing Active Directory Domain Services Sites and Replication
By default, automatic site link bridging:
Enables ISTG to create connection objects between site links
Allows disabling of transitivity in the properties of the IP transport
Site link bridges:
Enable you to create transitive site links manually
Are useful only when transitivity is disabled
To describe site link bridging, mention that by default, site links are transitive, or bridged. For example, if site A has a common site link with site B, and site B has a common site link with site C, then the two site links are bridged. Therefore, domain controllers in site A can replicate directly with domain controllers in site C, even though no site link exists between sites A and C. In other words, the effect of bridged site links is that replication between sites in the bridge is transitive.
If the routing configuration for an organization is structured so that all domain controllers in all sites can communicate directly with domain controllers in other sites, you do not need to change the default configuration. However, you can modify the replication topology, and then force additional hops in the replication process by disabling automatic site-link bridging for all site links, and creating new site link bridges.
SEA
AMS
Beijing HQ
HQ-SEA
Site Link
Bridge
HQ-Beijing Site Link
HQ-AMS Site Link

24. What Is Universal Group Membership Caching?
5: Implementing Active Directory Domain Services Sites and Replication
Universal group membership caching enables domain controllers in a site with no global catalog servers to cache universal group membership
Universal group membership caching makes it possible to log on to AD DS without contacting a global catalog. Once this option is enabled and a user attempts to log on for the first time, universal group membership is cached on nonglobal catalog domain controllers.
Once this information is obtained from a global catalog, it is cached on the site’s domain controller indefinitely, and is updated periodically. By default, updates occur every eight hours. Enabling this feature results in faster logon times for users in remote sites without global catalogs, because the authenticating domain controllers do not have to access a global catalog. Organizations may choose to use universal group membership caching for a site for which they do not want to deploy a global catalog server.
Mention that replication has improved over the years, and that the best practice recommendation for most scenarios is to have a global catalog on every domain controller. One of the historical concerns with global catalogs was the schema update in Windows 2000 Server, which would trigger global catalog re- initialization.
You may want to discuss that universal group membership caching can be a security risk when an administrator relies on removing a user out of a group, because universal group membership caching is not updated with replication and the user has up to eight hours of access, and even more when the WAN link becomes offline. This caching method is also somewhat unpredictable: When users log on the first time at a remote site, and the global catalog is not available, the behavior is different than for users who logged on previously. Because of these issues, universal group membership caching is not typically a recommended approach.
Global Catalog Server
Bridgehead Server
IP Subnets
Bridgehead Server
IP Subnets

25. Managing Intersite Replication
5: Implementing Active Directory Domain Services Sites and Replication
Site link costs:
Replication uses the connections with the lowest cost
Replication:
Polling: Downstream bridgehead polls upstream partners
Default is 3 hours
Minimum is 15 minutes
Recommended is 15 minutes
Replication schedules:
24 hours a day
Can be scheduled
Describe the options for configuring intersite replication. The next topic provides a demonstration of these options.

26. Demonstration: Configuring AD DS Intersite Replication
5: Implementing Active Directory Domain Services Sites and Replication
In this demonstration, you will see how to configure AD DS intersite replication
Preparation Steps
To complete this demonstration, you must have the 20412C-LON-DC1 and 20412C-TOR-DC1 virtual machines running. Sign in on all virtual machines as Adatum\Administrator with the password Pa$$w0rd.
You also must have completed all previous demonstrations in this module.
Demonstration Steps
On TOR-DC1, in Server Manager, click Tools and then click Active Directory Sites and Services.
In Active Directory Sites and Services, expand Sites, and then expand Inter-Site Transports.
Click IP, right-click DEFAULTIPSITELINK, and then click Rename.
Type LON-TOR, and then press Enter.
Right-click LON-TOR, and then click Properties. Describe the Cost, Replicate every, and Change Schedule options.
In the LON-TOR Properties dialog box, next to Replicate every, configure the value to be 60 minutes.
Click Change Schedule.
Highlight the range from Monday 12 PM to Friday 4 PM, as follows:
Using the mouse, click at the Monday at 12:00 PM tile.
With the mouse button still pressed down, drag the cursor to the Friday at 4:00 PM tile.
Click Replication Not Available and then click OK.
Click OK to close the LON-TOR Properties dialog box.
In the navigation pane, right-click IP, and then click Properties.
In the IP Properties dialog box, point out and explain the Bridge all site links option.
Click OK to close the IP Properties dialog box.
(More notes on the next slide)

27. Tools for Monitoring and Managing Replication
5: Implementing Active Directory Domain Services Sites and Replication
Repadmin.exe examples:
Dcdiag.exe /test:testName:
Windows PowerShell
Discuss how you can use the Repadmin.exe and Dcdiag.exe tools to monitor AD DS replication. You may want to consider showing an example of some of the commands.
Other commands that you can discuss include:
Repadmin /bind – Useful to verify that remote procedure call (RPC) is working against a domain controller.
Repadmin /istg – Forces the ISTG to recalculate replication.
Briefly mention the AD DS Management Pack on Microsoft System Center 2012 R2 Operations Manager.

28. Additional Resources & Next Steps
Instructor-Led Courses
20412C: Configuring Advanced Windows Server 2012 Services
Books
Exam Ref : Configuring Advanced Windows Server Services
Exams & Certifications
Exam : Configuring Advanced Windows Server Services