AD Sites and Services

P

Paul h

Hi,
Can anyone tell me if there is a way to stop sites
generating automatic replication partners in AD sites and
services. Every while child domains automatically
generate replication partners and I have to delete them
manually, so that I only have the required partner there.

Thanks,
Paul
 
C

Cary Shultz [MVP]

-----Original Message-----
Hi,
Can anyone tell me if there is a way to stop sites
generating automatic replication partners in AD sites and
services. Every while child domains automatically
generate replication partners and I have to delete them
manually, so that I only have the required partner there.

Thanks,
Paul
.
Paul,

What are you trying to accomplish? Why are you removing
replication partners that are set up by the KCC ( which
does a pretty good job all by itself )?

Are you talking about INTRASITE or INTERSITE
replication? I would assume INTERSITE? Please advise.

Cary
 
P

paulh

-----Original Message-----

Paul,

Remember how Active Directory breaks up the replication
process. There are namely two "types": INTRASITE and
INTERSITE.

Intrasite is the replication that takes place amongst the
DCs in a particular Site. It happens, by default, every
15 minutes. Also, please keep in mind that there is a
replication link object between two DCs, for example, and
that this replication is a one way deal. There would be
another replication link object created to take care of
the replication in the other direction between these same
two DCs. Furthermore, remember that this replication link
is for replication of one of the Naming Contexts. When
you set up Sites properly this is all pretty much handled
by the KCC. It is a very nice process. You essentially
can leave it alone and it works just swell! This process
essentially happens automatically and dynamically for each
and every site that you have configured in Sites and
Services.

Intersite is the replication that takes place between
Sites. It is not "automagically" set up. You, the
Administrator, need to set this up as you see best. The
replication process happens, be default, every 180 minutes
( 3 hours ).

Further to this conversation, please note that there are
three Naming Contexts. Essentially, Active Directory has
chopped itself into three partitions, or Naming Contexts.
There is the Domain NC, the Configuration NC and the
Schema NC. The Domain NC is replicated to all DCs within
that particular Domain. Both the Configuration NC and the
Schema NC are replicated to all DCs in the entire Forest.

I usually find that installing the Support Tools and using
either the Active Directory Replication Monitor or the
command-line utility 'repadmin /showreps' is quite
useful. The Support Tools can be located in two places:
the WIN2000 Server CD in the Support | Tools folder or the
WIN2000 Service Pack CD in the Support | Tools folder. I
would opt for the Service Pack CD if possible.

It sounds like you have resolved the issue. I included
this long-winded post just for some general information
for you to have so that you are better armed for the next
problem. Also, another really good tool is the Event Logs.

HTH,

Cary
.
Hi Cary,

Thanks for the response and advice I will keep an eye on
things and see how they go.

Paul
 
K

K Berrien

Intrasite is the replication that takes place amongst the
DCs in a particular Site. It happens, by default, every
15 minutes.

15 minutes is a joke, and perhaps not entirely accurate. I have 2
DC's (W2K3) intrasite that DO take 15 minutes, and I can seem to do
nothing to change it. Absolute design flaw.

One DC is basically an auth server (per MS's recommendations of
splitting jobs) and the second a file server. Great, so you create a
user on the auth machine (so they can login) but have to wait 15
minutes (or "replicate now") to actually give them rights to their
home directory, etc....

"Where do my users want to go today?" Come back in 15 minutes and
we'll find out.
It is a very nice process. You essentially
can leave it alone and it works just swell!

huh???? Given my experience this sounds like a Balmer quote. <grin>
 
C

Cary Shultz [MVP]

-----Original Message-----


15 minutes is a joke, and perhaps not entirely accurate. I have 2
DC's (W2K3) intrasite that DO take 15 minutes, and I can seem to do
nothing to change it. Absolute design flaw.

One DC is basically an auth server (per MS's recommendations of
splitting jobs) and the second a file server. Great, so you create a
user on the auth machine (so they can login) but have to wait 15
minutes (or "replicate now") to actually give them rights to their
home directory, etc....

"Where do my users want to go today?" Come back in 15 minutes and
we'll find out.


huh???? Given my experience this sounds like a Balmer

.
K Berrien!

I read your comments with interest. I will say that
everyone has different experiences, of which some are
good and some are bad. Sometimes bad experiences are due
to a "design flaw" on the part of those programming the
particular product and sometimes bad experiences are due
to a lack of understanding on the part of those using the
particular product. And, naturally, there is the whole
myriad of situations in bwteen. ;-)

I am of the opinion that the way things are set up with
WIN2000 Active Directory replication is a good thing.
Sure, it is sometimes a pain in the backside when you
need to do something NOW!!!! and you have multiple DCs
with possibly multiple Sites in the picture. However,
with proper planning most of these situations can be
avoided. And the Support Tools sure do help!

I would further state that when you do have a "situation"
if you trace everything back you will find that someone
did not do his or her job in a timely manner. You know
the saying: " A lack of proper planning on your part does
not constitute an emergency on my part!". You have 15
people starting tomorrow morning and HR is just now
telling you about it ( and "now" is 7:15pm the evening
before they are to start! - how many times did I
literally experience that one? ).

Your Corporate Legal / HR team has just now informed you
that in 10 minutes Joe is going to be fired and they want
you to lock him out of everything: NOW! Well, it is
possible.

Take a look at the Support Tools and install them on all
of your WIN2000 / WIN2003 Servers. Naturally, install
the WIN2000 Support Tools from either the WIN2000 Server
CD or from the WIN2000 Service Pack CD on your WIN2000
Servers and the WIN2003 Support Tools from the WIN2003
Server CD on your WIN2003 Servers. Then take a look at
the Active Directory Replication Monitor Tool (
Replmon ). There is a whole lot that you can do with
this tool, including forcing replication to take place
RIGHT NOW! I have not yet played with the WIN2003 Server
Support Tools so I can only assume that Replmon is still
there!

Also, take a look at how replication really takes place.
Dig a little deeper, get past the surface and you will
find that it is really quite interesting how all of this
works so well.

Understand this: I am very aware of the "problems" with
Microsoft Products. Anyone who has dealt with MS
Products knows to expect some bugs. That is why a lot of
people wait for the first Service Pack to come out, and
then let others be their testing ground! However, I
truly believe that MS is catching up with all of this and
doing a pretty great job at putting security / stability
first ( over added functionality ). I worked for several
months at HAVAS Interactive in Torrance, CA and saw from
the inside what all goes into releasing an application.
And we are talking about children's educational
software! Hardly as complex as an Operating System or an
Office Suite.

I am sorry that you are having a bad experience.

HTH,

Cary
 
K

K Berrien

I've played with the various replication tools, and had some great
suggestions from the newgroups. In Win2k it seems to NTDS registry
change/add is very popular, but it appears one can not do this in
2003. Sure, I can replicate now within Site & Services after
traversing like 5 menus. 15 minutes for servers sitting on the same
switch is just a bad idea which ever way I look at it, 5 I might
understand.

My kinda burning pisser, the only time I actually wanted support
direct from MS, and I have to pay $250 just to find out if its a known
issue. Don't get me wrong, I've used windows for years and its
generally a good platform. I have some big problems with the company
and its strategies (we massachusetts natives love the fact our Attny
Gen hasn't settled yet!).

But, given that we'd have stayed away from Windows all together if it
were not for the need of AD for XP clients, and there really isn't any
other viable option other than XP clients.

Come on samba guys... get crackin!
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top