Active Directory Operations
Now that we've reviewed what is what in Active Directory, we'll review how it works. Understanding the relationships between DCs is important when designing an Active Directory topology.
Information Is Replicated to DCs
If a change is written to Active Directory, the DC must replicate the change to all other DCs in the domain. Also, if a new DC joins the domain, the Active Directory partitions are replicated to the new server. It might seem like there is a lot of replication every time a change is made to Active Directory, but the benefits of fault tolerance and end user performance are worth the added traffic. Also, remember that the domain partition is replicated only between DCs in the same domain, and replication can be scheduled with sites.
GC Server in the Physical Structure
As mentioned earlier, the GC is a partition that is replicated only to DCs that are configured as GC servers. The location of GC servers in your organization is an important design decision because clients require access to GC servers when they log on. Universal group membership is stored in the GC. Because Universal groups can deny access to resources, a user's membership to the Universal groups must be discovered during logon in order to build the logon access token. In addition, the GC server enables clients to view objects outside their own domain.
Partitions are physical storage containers that contain a specific type of data for Active Directory. For each Active Directory there is a schema partition, a configuration partition, and a domain partition for each domain. The Active Directory domain partitions segment each domain's directory information. The objects in each domain partition are identified by their DN. The GC hosts all objects within the forest, but not all their attributes. The GC has the DN of each object and, therefore, has enough information to locate a replica of the partition that holds the object.
The naming context, not to be confused with the namespace, represents a contiguous subtree of the directory and is a unit of replication. A partition is a naming context and is therefore replicated. In Active Directory, a single server always holds at least three naming contexts:
Configuration—This naming context contains physical data for sites, services, and partitions.
Domain—This naming context is the default unit of replication and contains domain directory data.
Schema—This naming context contains the schema for the entire Active Directory.
When DCs replicate, each of these naming contexts is replicated between the appropriate DCs.
Naming Context Replication
Naming contexts replicate between DCs so that each DC has up-to-date directory information for its clients. It is important to remember, however, that not all naming contexts replicate between all DCs. Remember that the domain naming context replicates only between DCs within a domain, and the GC replicates only between GC servers.
Naming context replication within a site uses RPC replication, which is referred to as IP in the user interface. All DCs within a site replicate using RPCs and are unschedulable. The RPCs used during replication require a certain level of available network bandwidth. This means that the DCs within a site must be well connected to the network. If the available bandwidth between DCs becomes limited, the RPCs might fail, thus causing replication failures. Hence, it is important to define a site architecture that groups DCs on a network that has adequate available network bandwidth.
After a domain structure is divided into sites, those sites must be connected using site link connectors. Site link connectors can use two transports: SMTP and RPC.
The IP (RPC) site link connector suffers from the same limitations as RPCs do within a site, which is that RPCs are not reliable across unstable links. Therefore, sites with limited or unstable network connections between them should use SMTP as the transport for the site link connector. Site link connectors also use compression, which makes intersite replication more efficient. One important caveat in choosing a protocol for your site link connector is that the domain naming context cannot be replicated between sites using the SMTP transport. Therefore, sites and domains must be defined so that all DCs within a site have adequate available network bandwidth. A domain can still be divided up into multiple sites for purposes of client connectivity, but those sites must use the RPC transport between sites. This means that domain boundaries must be evaluated depending on the available bandwidth between sites.
The SMTP transport, which is asynchronous and streams data between DCs, is more stable and reliable across networks that have unreliable network connections.