Software

Ask something
Question Locked

Microsoft AD replication suggestion.

0 helpful
5 replies

by zaidumer

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Help me out here.. need suggestions..

We are running a single domain environment with 3 locations

* Head Office
* Branch1
* Branch2
* Branch3

Head Office has the DC1 (global catalog) with all FSMO roles and an additional DC2 (not a GC).

Branch 1, 2 & 3 each has an additional domain controller (which are also Global Catalog holders) that is suppose to provide user logon services to their users respectively.

All these branch connect to the Head Office via 512Kbps ADSL link.

my question .. If all my FSMO roles are on the DC1 at the head office, then who is providing the logon services to the branch users.?? DC1 at head office or the additional DC at the branch. ?

secondly... if the links between the branch and head office breaks for 3 - 4 days ?? what is the impact on the branch users ? will the additional DC at the branch serve their login requests ????

thirdly.. should my replication be between each DC to all the other 4 DCs on the entire network ??

ie. Branch1 DC replicates to head office DC1, DC2, branch2 DC and branch3 DC..... Similarly branch 2 DC replicates to the other 4 DCs.. sort of like a fully meshed network replication .... that?s what we have going on right now.

Or should it be that the Branch DCs replicate to the head office DCs only.. ?? like a centralized update location ??

so if Branch 1 DC replicates to Head office DC1 &DC2 , in return the head office DC1 & DC2 replicates the updates to DCs at Branch2 and Branch 3.

Regards,
zaid

5 replies

by lowlands

Workstations should pick the closest DC based on the site they're in. So you'll have to make sure you set up your sites and subnets properly in AD. Only older workstation versions (NT, 95) will use the DC with the PDC emulator role.

If you set you're sites up properly, AD (the KCC) will determine the best replication architecture.

by why me worry?

If so, then you don't need to place global catalogs at every site, as was required in Windows 2000. Windows Server 2003 now uses universal group caching and will cache local credentials in the event the WAN link is down and can't get to the server hosting the global catalogue FSMO role. Sites are definitely the way to go for many reasons, such as group policy targeting of all users or machines per site, and control of AD replication using the KCC.

by cg it

but.. the design parameters of sites still follows the old W2K best practices. That is there are no servers, few users and an reliable fast WAN link, you don't need a DC at the site. [few users are 5 to 6, no servers means no file, DB, servers and you don't have 5 or more sites].

If you have 3 sites with 10 to 20 users per site, it's best to have a DC with the global catalog role for local authentication.

The reason is that every morning, users will log in. With 3 sites with 10 to 20 people per site plus those users at HQ, the DC will might not be able to handle it.

by zaidumer

Hmm ok il look at the knowledge base for KCC replication..

as far as the users and sites are concerned.
i have 3 remote locations (all configured in the Default_First_Site_Name in ites and services)

each of these locations have 80-100 users while ehe head office has more of less 160 users.

thats y i have places a GC at each additional DC on these remote locations.

to be precice i dont want branches to communicate with each other directly by bypassing the head office. ( im actually a core network guy ) and dont want a meshed topology.. where as the system admin wants this cause the servers appear automatically in the NTDS settings option and he dont want them.)

i suggested that he set up sites accordingly and give cost values to these links. since that would lower the unnecessary replication cost ..

correct me if im wrong and making his life hell un-necessarly :P

This discussion is closed to new replies.