Step-by-Step Guide to Active Directory Sites and Services

Published: September 17, 2004 This guide explains how to use the Active Directory Sites and Services snap-in to administer replication topology both within a site in a local area network (LAN) and between sites in a wide area network (WAN).

Overview
The primary purpose of the Windows Server 2003 Active Directory Sites and Services snap-in is to administer the replication topology of an enterprise environment both within a site in a LAN and between sites in a WAN. Note: The Appendix provides additional information on how Active Directory service replication is performed. If you are not familiar with replication, you may want to review the Appendix prior to continuing.

Sites
A site is a region of your network with high bandwidth connectivity and, by definition, is a collection of well-connected computersbased on Internet Protocol (IP) subnets. Because sites control how replication occurs, changes made with the Sites and Services snap-in affect how efficiently domain controllers (DC) within a domain (but separated by great distances) can communicate. A site is separate in concept from Windows Server 2003based domains because a site may span multiple domains and a domain may span multiple sites. Sites are not part of your domain namespace. Sites control replication of your domain information and help to determine resource proximity. For example, a workstation will select a DC within its site with which to authenticate. To ensure the Active Directory service can replicate properly, a service known as the Knowledge Consistency Checker (KCC) runs on all DCs and automatically establishes connections between individual computers in the same site. These are known as Active Directory connection objects. An administrator can establish additional connection objects or remove connection objects. However, at any point where replication within a site becomes impossible or has a single point of failure, the KCC steps in and establishes as many new connection objects as necessary to resume Active Directory replication. Replication between sites is assumed to occur on either higher cost or slower speed connections. As such, the mechanism for inter-site (between sites) replication permits the selection of alternative transports and is established by creating Site Links and Site Link Bridges.

Default-First-Site
Your first site was set up automatically when you installed Windows Server 2003 on the first domain controller in your enterprise. The resulting first site is called DefaultFirst-Site. You can rename this site later or leave it as is. The replication topology of sites on your network controls: Where replication occurs, such as which DCs communicate directly with which other DCs in the same site. Additionally, this topology controls how sites communicate with each other. When replication occurs. Replication between sites can be completely scheduled by the administrator. Replication between DCs inside the same site is notificationbased, where notifications are sent within five minutes of a change being made to an object in the domain. All newly promoted DCs are placed in the Site container that applies to them at the time of installation. For example, a server bound for California might have been initially built and configured in the Maui, Hawaii, data centertherefore, the Configure Your Server wizard places the server in the Maui site. After it arrives in California, the server object can be moved to the new site using the Sites and Services snap-in. You can use the sites portion of Sites and Services snap-in to: Display the valid sites within an enterprise. As an example, Default-First-Site might be a site name such as Headquarters. You can create, delete, or rename sites. Display the servers that participate in a site. You can delete or move servers between sites. (Note: Although you can also manually add servers, the task of adding a server is typically performed automatically during Domain Controller setup.) Display the applications that use site knowledge. The Active Directory topology is rooted at Sites\Default-First-Site\Servers. This contains just those servers participating in a specific site, regardless of domain. To view the connections for any given server, display Sites\Default-First-Site\Servers\{server}\NTDS Settings. For each server, there are connections and schedules that control replication to other servers in this site. Connections. For two machines to have two-way replication, a connection must exist from the first machine to the second, and a complimentary connection must exist from the second machine to the first. Schedules. Within a site, pull replication of new directory deltas occurs between servers approximately every five minutes. Schedules are significant within a site to force periodic notification to in-bound partners in the event that a partner has a damaged connection object. This type of notification typically occurs every six hours. In addition, schedules are very significant in controlling pull replication between sites. (There is no automatic five-minute replication between sites.) Display transports and links between sites. Transports represent the protocols used to communicate between chosen sites (for example, IP). Display subnets. Subnets allow the administrator to associate ranges of IP addresses with sites.

Prerequisites
Part 1: Installing Windows Server 2003 as a Domain Controller Step by Step Guide to Setting Up Additional Domain Controllers Step-by-Step Guide to Building a Site-to-Site Virtual Private Network Connection Top of page

Using the Sites and Services Tool

To start the Active Directory Sites and Services tool 1On HQ-CON-DC-01, click the Start button, point to All Programs, point to .Administrative Tools, and then click Active Directory Sites and Services. A console appears as shown in Figure 1.

Figure 1. The Active Directory Sites and Services Snap-In

Changing Site Properties

To change the Default-First-Site-Name 1Click the plus sign (+) to expand the Sites tree. . 2Right-click Default-First-Site-Name in the left pane of the console, and then click .Rename. 3Type Seattle-WA, and then press Enter. .

Creating a New Site

Sites in Active Directory represent the physical structure, or topology, of your network. Active Directory uses topology information, stored as site and site-link objects in the directory, to build the most efficient replication topology. You use Active Directory Sites and Services to define sites and site links. A site is a set of well-connected subnets. Sites differ from domains; sites represent the physical structure of your network, while domains represent the logical structure of your organization. To add a new site 1Right-click Sites in the left pane of the console, and then click New Site. . 2In the New ObjectSite dialog box, type Vancouver-BC for the new site name. . 3Click to highlight DEFAULTIPSITELINK, and then click OK. .(Note: Site Links are explained later in this document.) 4Review the Active Directory message box information, and then click OK. .

Moving Computers within Sites

You can now move computers from other sites into this site from within the Servers container of each site. Note: Computers are assigned to sites based on their IP address and subnet mask. Site assignment is handled differently for clients and member servers than for domain controllers. For a client, site assignment is dynamically determined by its IP address and subnet mask during logon. For a domain controller, site membership is determined by the location of its associated server object in Active Directory. To move computers into a site 1In the Active Directory Sites and Services snap-in, click the plus sign (+) next to .Seattle-WA, and then click Servers. 2In the results pane, right-click HQ-CON-DC-02, and then click Move. . 3In the Move Server dialog box, click Vancouver-BC as shown in Figure 2, and .then click OK.

Figure 2. Moving a Computer Between Sites 4Repeat steps 2 and 3 to move HQ-CON-DC-03 to the Vancouver-BC site. . 5In the left pane, click the plus sign (+) next to Vancouver-BC, click Servers, and .verify that both servers are now assigned to the site.

Working with Subnets

As detailed previously, a site is a set of computers well-connected by a high-speed network, such as a LAN. All computers within the same site typically reside in the same building or on the same campus network. A single site consists of one or more IP subnets. Subnets are subdivisions of an IP network, with each subnet possessing its own unique network address. A subnet address groups neighboring computers in much the same way that postal codes group neighboring postal addresses. Each site is associated with one or more subnets. To add a subnet for a particular site 1In the left pane of the console, click Subnets, right-click Subnets, and then click .New Subnet. 2In the New ObjectSubnet box, type the Address and Mask numbers as shown in .Figure 3, click to highlight Vancouver-BC, and then click OK.

Figure 3. Adding a Subnet Once a subnet has been properly created, it will appear under the Subnets folder. Although the subnet was associated with the Vancouver-BC site during its creation, it may be modified to point to an alternate site. To associate the subnet with a particular site 1Under the Subnets folder, right-click the 30.0.10.0/24 subnet, and then click .Properties. 2In the 30.0.10.0/24 Properties dialog box, select the site to associate with this .subnet from the list box as shown in Figure 4, and then click OK.

Figure 4. Associating a Subnet with a Site 3Click the Location tab, and then provide a description for the sites location. For .this example, type Vancouver, and then click OK.

Site Links
Creating a site link between two or more sites is a way to influence replication topology. By creating a site link, you provide Active Directory with information about what connections are available, which ones are preferred, and how much bandwidth is available. Active Directory uses this information to choose times and connections for replication that will afford the best performance. For scheduled replication to occur between multiple sites, both sites must agree on a transport to communicate. Typically, Site Links will be based on IP. To create a Site Link 1Click the plus sign (+) next to Inter-Site Transports, right-click IP, and then click .New Site Link. 2In the New Object Site Link dialog box, type PNW-Slow Connection for Name .as shown in Figure 5, and then click OK.

Figure 5. Creating a Site Link 3In the right-side results pane for IP Site Links, double-click the newly created .PNW-Slow Connection link. 4In the PNW-Slow Connection Properties dialog box, type Replication Every 24 .Hours for the Description, change the Replicate every setting to 1440, and then click OK. Note: If you delete the DEFAULTIPSITELINK, replication between Seattle and Vancouver will occur every 24 hours over IP via the PNW-Slow Connection site link.

Site Link Bridges

By default, all site links are bridged, or transitive. This allows any two sites that are not connected by an explicit site link to communicate directly through a chain of intermediary site links and sites. One advantage to bridging all site links is that your network is easier to maintain because you do not need to create a site link to describe every possible path between pairs of sites. Generally, you can leave automatic site link bridging enabled. However, you might want to disable automatic site link bridging and create site link bridges manually just for specific site links, in the following cases. Your network is not fully routed (not every domain controller can directly communicate with every other domain controller). You have a network routing or security policy in place that prevents every domain controller from being able to directly communicate with every other domain controller. Your Active Directory design includes a large number of sites. Top of page

Appendix: Replication Topology Concepts

Replication Overview
Except for very small networks, directory data must reside in more than one place on the network to be equally useful to all users. Through replication, Active Directory maintains replicas of directory data on multiple domain controllers, ensuring directory availability and performance for all users. Active Directory uses a multimaster replication model, allowing you to make directory changes at any domain controller, not just at a designated primary domain controller. Active Directory relies on the concept of sites to help keep replication efficient, and on the KCC to automatically determine the best replication topology for the network. Organizing Data for Replication Data is stored on each domain controller in the directory store, which is divided logically into specific directory partitions. Each partition stores a different type of directory data; domain data, forest schema data, forest configuration data, or application data. All domain controllers within a forest hold a replica of the schema and configuration partitions for that forest and all domain controllers within a particular domain hold a replica of the domain partition for their domain. Application directory partitions hold directory data specific to a particular application and can be stored by domain controllers belonging to different domains. Changes to each directory partition are replicated to all other domain controllers that hold a copy of that partition. Replication also ensures the availability of the global catalog throughout the entire forest. The global catalog is a searchable directory store containing data about every

object in all domains. The global catalog is stored by domain controllers for which the global catalog has been enabled. Improving Replication Efficiency with Sites To help make replication more efficient, Active Directory relies on sites. Sites, defined as groups of well-connected computers, determine how directory data is replicated. Active Directory replicates directory information within a site more frequently than among sites. This way, the best connected domain controllers, those most likely to need particular directory information, receive replicated updates first. The domain controllers in other sites also receive the changes, but less frequently, reducing network bandwidth consumption. Determining the Replication Topology The KCC, a process running on each domain controller, automatically identifies the most efficient replication topology for your network, based on information you provide about your network in Active Directory Sites and Services. The KCC regularly recalculates the replication topology to adjust for any network changes that have occurred. The KCC of one domain controller within each site (the intersite topology generator) determines the intersite replication topology. Top of page

Additional Resources
For more information, see the following resources. Active Directory Replication at http://www.microsoft.com/resources/documentation/windowsserv/2003/all/deploygui de/en-us/dssbg_rent_opyz.asp For the latest information about Windows Server 2003, see the Windows Server 2003 Web site at http://www.microsoft.com/windowsserver2003 Top of page Published by Microsoft Corporation, http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/dire ctory/activedirectory/stepbystep/adsrv.mspx