One important area of Active Directory (AD) management is replication of domain controllers (DCs), especially across multiple sites (Figure 1). Separate domains for each of the physical locations is not necessary – multiple domains are more complicated to manage in most cases than multiple locations for a single AD domain. Active Directory recognizes the physical subdivision and adjusts replication to reflect this. For example, AD replication between sites uses data compression and occurs far less frequently than on a local network.

Figure 1: Replication between sites lets you map physically separate networks in Active Directory.

Active Directory uses its own service to manage replication automatically within and between sites. This service, known as the Knowledge Consistency Checker, connects the domain controllers of the various sites and automatically creates a replication topology on the basis of defined schedules and site associations.

If more than one DC is available at each site, not all are replicated between sites. Intelligent mechanisms detect grouped DCs and control their replication, as well, so that a slower line between sites is not unnecessarily disrupted by AD replication. Each site has bridgehead servers that pass the information from their own AD site to the bridgehead servers at the other sites. In this way, you also minimize data traffic, because not all DCs transmit data externally.

AD Replication Basics

To use replication between sites, you first need to define it and then assign independent IP subnets. These subnets are stored in the Active Directory Management console and distinguish the sites from then on. You can then create links between the subnets and finally distribute the existing DCs to the individual sites. This kind of routing topology means you need to configure the schedules and investigate the cost of the best possible replication.

The management tool you need is the Active Directory Sites and Services snap-in (Figure 2). The fastest way to launch it on a domain controller or on a computer with the Remote Server Administration Tools (RSAT) is with dssite.msc. Of course, you can also use PowerShell. To create new sites, you must be a member of the Organization Administrators group.

Figure 2: Creating new AD sites in the Active Directory Sites and Services snap-in.

Once you have defined sites and the associated subnets, DCs will automatically be assigned as a function of the subnet to which the IP address belongs. You then need to assign to the right sites existing DCs or servers previously assigned to a location. You can also define these while upgrading the DCs.

To connect each site to the head office, you do not need to use a star topology. Replication in Active Directory also lets you integrate sites that are connected to other sites but not to the head office. Active Directory can manage this, provided you defined the sites and subnets correctly.

Creating New Sites

When you open the Active Directory Sites and Services snap-in, below the Sites entry you will see Default-First-Site-Name as the first site. Active Directory always automatically has one site. In the first step, make sure you assign a meaningful name to this site; you can do so in the context menu.

Next, create the additional sites where you want to install DCs by right-clicking Sites in the snap-in and selecting New Site from the context menu. In PowerShell, use the

New-ADReplicationSite <site>

command. At this point, no extensive configuration is required for the time being, and if you don't have a DC at the site, creating sites will not affect replication in Active Directory.

When you create a new site in the snap-in, a window opens in which you need to specify its name and the site link. You can use the link to manage replication. The settings for this can be changed at any time. By default the DEFAULTIPSITELINK link already exists. Now create a list of locations with a CSV file that starts with the line name. It can then be imported with the command:

Import-Csv -Path C:\newsites.csv | Import New-ADReplicationSite

Creating IP Subnets

After creating the sites, create the IP subnets and assign them to the respective sites. To create a new subnet, right-click Subnets in the snap-in and select New Subnet from the context menu.

If desired, you can create IPv6 subnets. After you create the subnet, the console displays it below the menu item of the same name. At this point, you will also want to create IP subnets on which no domain controllers are installed but that member computers that log on to the DC may be running. You need to assign them to the appropriate sites.

If you click Subnets , you will see all the IP subnets and their assigned sites on the right. You can assign subnets to specific sites at any time in the subnets' properties. Sites can be created retroactively, and new subnets can be assigned to existing sites.