AD replication and GPO

[Rich]

How long does it normally take for a GPO to be enabled and
put in use on a domain? I have a Policy that after three
days started working. The only thing I have done since
enabling it is to do a Force Replication on all my DC's.

Also how many changes should be made at one time on a DC
without causing problems? If to many changes are made at
one time will it cause Domain instability?

Thanks

Rich

 

[Jim Singh]

It really all depends on how many sites, DCs you have, what kind of
replication schedule you have and what kind of connectivity between those
sites and DCs, it could take days before a change (like GPO) can replicate
through out the forest based upon that.

Usually by defualt DC within site replicate changes every 5 mins, this
setting changes when you have inter site replication, which is by default is
180 minutes and once every hour. You could change this setting for
replication to occur more often but that decesion should be based upon
connectivity because replication between site more often can cause
bottlenecks.

There is no set limit as to how many changes you can make on a DC that would
cause instablity. AD has multi master replication which means any time a
change occurs on a DC its replicates that change with other DC.

-Jim

 

[ptwilliams]

How long does it normally take for a GPO to be enabled and put in use on a
domain? I have a Policy that after three
days started working. The only thing I have done since enabling it is to do
a Force Replication on all my DC's.

There are several variables. But basically, you modify the GPO and that
change is (intra-)replicated in 5 mins to all direct replication partners
(15 mins if you've loads of DCs due to the max-3 hop limit). Inter-site
replication can be three hours, so nine if there's a transitive three-hop
replication partner. However that's unlikely!! By default background
policy processing happens every 90 mins (but will only actually apply if the
GPO's version has changed). However a DC ay get the new GPO five mins after
this interval has run so those clients would have to wait another 90 mins...

What's more likely is that you've either got replication problems between
some (or all) DCs or you modified settings that are not processed by
background processing; which means that a reboot or logon is needed. Check
through your event logs to be sure.

Also how many changes should be made at one time on a DC without causing

problems? If to many changes are made at one time will it cause Domain
instability?

There is no limit that I know of. I doubt you'll reach a limit that causes
any problems!!!


--

Paul Williams
_________________________________________
http://www.msresource.net


Join us in our new forums!
http://forums.msresource.net
_________________________________________


How long does it normally take for a GPO to be enabled and
put in use on a domain? I have a Policy that after three
days started working. The only thing I have done since
enabling it is to do a Force Replication on all my DC's.

Also how many changes should be made at one time on a DC
without causing problems? If to many changes are made at
one time will it cause Domain instability?

Thanks

Rich