Good day, Cloud Gurus, and welcome back.
In this lesson, we're
going to explore Active Directory sites and replication.
Let's take a look at what we're going to cover.
First up, we'll take a look
at Active Directory database partitions
and then we'll do a quick demo
where we will create a new Active Directory partition.
Then we'll take a moment to understand the system volume,
more commonly referred to as SYSVOL.
We'll explore Active Directory sites.
We'll take a look at Active Directory replication,
and then finally, we'll do a demo
where we'll take a look at creating
and managing Active Directory sites.
Before diving into partitions,
let's take a closer look at the Active Directory database.
The Active Directory database
is stored on each domain controller.
It's a JET database stored in a file named ntds.dit.
And I'm telling you it's a JET database
only because it's useful to know
that it's not something like a SQL server database,
just in case Microsoft tries to trick you on the exam.
And now, while it's only just one file,
it's actually split up into many partitions
and the partitions are important to know
because each partition of the database
can have a different replication configuration.
Let's take a look at the partitions.
The first is the configuration partition
and it's created automatically
when you create the first domain controller in the forest.
The configuration partition contains information
about the forest-wide
Active Directory domain services structure,
including which domains and sites exist,
and which domain controllers exist in each domain.
This partition replicates
to all domain controllers in the forest.
And the second is the schema partition.
And we spoke about this a little bit earlier.
The schema partition contains definitions
of all of the objects you can create
and the attributes that those objects can have.
And it also contains the rules
for creating and manipulating those objects.
And as we mentioned previously,
schema information replicates
to all domain controllers in the forest.
The next partition is the domain partition.
And when you create
a new Active Directory Domain Services domain,
it automatically creates a domain partition.
And the domain partition contains information
about domain-specific objects,
including users, groups, and organizational units,
and some domain related system settings,
and it's replicated to all domain controllers
in the same domain.
And then finally,
the Active Directory database is extensible.
We know that we can extend the schema
and some applications will do this
but there is also the option
to create additional partitions.
These are known as application partitions
and the application partition
stores non-domain application related information.
And it's often updated more frequently.
If you remember back when we introduced DNS,
we mentioned that it can be stored in a file
or it can be stored in the Active Directory database.
By default,
when you use Active Directory integrated DNS zones,
2 application partitions are created.
The first application partition is forest DNS zones.
And these DNS zones
are replicated to every domain controller in the forest.
And the second application partition is domain DNS zones.
And these zones are replicated
to all domain controllers in the domain
and you can also create custom application partitions
and replicate those partitions however you choose.
And you can even do this with a DNS zone.
And here's a tip for you for the exam.
You can create a custom application partition
for a DNS zone with either the ntdsutil
or the dnscmd command-line utility.
All right, let's take a look at a demo
of creating a custom partition using ntdsutil.
All right, so here we are on DC01
and we're going to use the ntdsutil command-line utility
to create a custom Active Directory partition.
Before we start, let's switch over to command prompt
because there's some compatibility issues
with Windows PowerShell and ntdsutil.
All right, now let's go ahead and run ntdsutil
and then now we'll go ahead and activate the instance ntds,
which is the Active Directory database.
Now we're going to enter the petition management context,
so that we can manage the Active Directory partitions.
And now we need to enter the connections context,
so that we can connect to the Active Directory server.
And then we're going to run the command
to connect to the domain controller.
All right, now we're successfully connected
and it's worth pointing out here
that I'm logged on with a user account
that is a member of the schema admins group.
Now that we're connected to the server,
let's go ahead and quit the connections context.
Let's go ahead and run the list command
to view the current Active Directory partitions.
And we can see here that we have the 5
built-in Active Directory partitions that we expect,
including the 2 application partitions for DNS.
Now, one thing to be aware of
is that Microsoft uses the term partition
and naming context interchangeably.
Just be aware that if you see Microsoft
referring to partitions as naming contexts,
for our purposes they're the same thing.
All right, let's go ahead and create a new partition.
And we do that by running the create nc command.
And that's where that naming context comes in.
So we're going to go ahead and run create
and then nc for naming context.
And then we need to provide a common name
for our new application partition.
And a common name is just another way
to uniquely identify an Active Directory object.
And then finally,
we need to provide the name of the domain controller
we're connecting to, to create this partition.
And now we can go ahead and run that command.
And we can see that we've successfully
added the new application partition.
Let's go ahead and run the list command
to view the new application partition.
All right, and we can see our new application partition
created in the Active Directory database.
All right, that wraps up this demo.
Let's continue on.
All right, now let's take a look at the system volume,
more commonly referred to as SYSVOL.
It's important to know that SYSVOL is a directory
that's shared with all domain computers and users,
and that it's replicated to all domain controllers
in the domain.
So, what does this SYSVOL directory contain?
The first thing SYSCOL contains is netlogon shares,
which contain scripts and configuration settings
that are used to configure
domain joined computers and users.
And it also contains group policy,
which are configuration settings
that are applied to domain users and computers.
And we'll be covering group policy
in great detail later on in this course.
But right now, it's important to know
that there is a shared system volume folder
on each domain controller.
And that that folder is replicated
to every domain controller in the domain.
It's also important to know that this replication
isn't the same as Active Directory database replication.
Instead, SYSVOL uses a different type of replication
referred to as distributed file system or DFS.
And we'll be covering DFS later on in this course.
But SYSVOL and the Active Directory database
do share some replication configuration.
Let's take a look at that now.
Before we look at replication,
we need to understand the concept
of an Active Directory site.
An Active Directory site
is a representation of a physical location.
For example, you might have an Active Directory site
for each office your company has.
If you had an office in Brisbane
and another office in Perth,
you might have an Active Directory site
configured for each of those offices.
And Active Directory sites
are defined by the subnets used at that site
and the domain controllers that are located at that site.
And the subnets are the CIDR address block ranges
used to assign IP addresses
to domain joined computers at that site.
Let's take a look at what the purpose
of an Active Directory site is.
The first purpose of an Active Directory site
is to control replication.
Replication performed within a site
is performed differently
to replication performed between sites.
And this is done to improve speed and efficiency.
Another important purpose of Active Directory sites
is client affinity.
Active Directory sites are used to help clients
find a domain controller that is close to them
based on their network address,
which improves performance when the clients need to interact
with a domain controller.
And SYSVOL replication is also based
on the configuration of Active Directory sites.
Active Directory sites are also used by other services.
Services can publish their location
to allow clients to locate them easily.
And printers are one example of this.
Now let's take a look at Active Directory replication.
Intrasite replication,
that is replication within an Active Directory site,
is performed quickly using two-way replication
between each domain controller in a ring.
And as you would expect,
changes made using this type of replication
are replicated quickly
to the other domain controllers in the site,
whereas intersite replication
is performed once between each site
and replication between sites is performed over a site link.
And the replication between sites
is performed between 2 servers
referred to as bridgehead servers.
And these bridgehead servers can be configured automatically
by Active Directory or they can be configured manually.
And finally, replication between the domain controllers
in the remote site is the same as the first site.
That replication is two-way
between each domain controller in a ring.
All right, let's take a look at a demo
of configuring Active Directory sites.
In the previous lesson,
we deployed 2 domain controllers in our Brisbane office
and one in our Perth office.
In this demo, we're going to configure
Active Directory sites to mirror the network topology.
We're going to rename the default site to the Brisbane site
and we'll create a new Perth site.
And then we will add the subnets for each of the sites.
And then we will ensure a site link is present
between the 2 sites.
All right, so here we are logged onto
our internal administrative server, ADM01,
and we're going to use Active Directory sites and services.
We'll go ahead and expand the sites node.
And then we're going to rename the default first site name
and we're going to rename that to our Brisbane site.
So, we'll go ahead and right-click
the default first site name and then we'll select Rename.
We'll call our default first site, Brisbane,
and then we're going to go ahead
and create a new site for our Perth office.
So, we'll right-click the site's node and select New Site.
And we're going to go ahead
and enter the name Perth for this site,
and we'll use the default IP site link
and we'll go ahead and click OK.
And then we'll receive a message,
just letting us know
that we need to add our subnets to our new site
and add our domain controllers to our site.
We're aware of that, so we'll go ahead and click OK.
All right, now let's go ahead
and confirm our subnets are configured correctly.
We'll select the Subnets node.
All right, looks like there's no subnets configured.
Let's go ahead and add our subnets.
So, we'll right-click, select New, and then Subnet.
And we'll enter in the IP address prefix
for our Brisbane subnet,
which is 10.1.0.0/16
and then we'll select our Brisbane site and go okay.
And then we'll go ahead and add another subnet for Perth.
So, we'll right-click again, Add New, and then Subnet.
And we'll go ahead and enter in the network prefix
for our Perth office, which is 10.2.0.0/16.
We'll go ahead and select our Perth site
and then we'll click okay.
All right, with our 2 sites created,
let's go ahead and move our domain controllers
into the correct sites.
We'll select the Brisbane site
and then we'll double-click the Servers node.
And we can see here
that we've currently got our 2 Brisbane domain controllers
and our Perth domain controller in the Brisbane site.
Let's go ahead and move our Perth domain controller
to the Perth site.
We'll right-click that domain controller
and we'll select Move,
and then we'll move it to our Perth site.
And click OK.
All right, finally, we just want to check
that a site link exists
between our Perth and our Brisbane sites,
so we'll navigate to intersite transports.
SMTP is being removed from a future version of Windows,
so we're going to select IP.
And we can see that we've got
that default IP site link created.
Let's go ahead and double-click that site link
and you can see that our Brisbane
and our Perth sites are in this site link.
And you can see that in the properties of the site link,
you can configure how often replication occurs
between these 2 sites.
And you can also change the schedule
to only replicate during certain hours.
We'll go ahead and click OK.
All right, and that concludes this demo.
Let's wrap up with a bit of a summary of what we've covered
and some key takeaways.
All right, so what have we covered in this lesson?
It's important to know that the Active Directory database
is split into partitions
and the default partitions are the configuration, schema,
and domain partitions.
The configuration and schema partitions
are replicated to all domain controllers in the forest.
And the domain partition is replicated
to all domain controllers in the domain.
Custom application partitions
can be created and configured to replicate as required,
and DNS is an excellent example of an application partition.
It's also important to remember that Active Directory sites
are used to control replication
and help clients locate services close to them,
including importantly, domain controllers.
And it's also important to remember
that sites are defined by the subnets in that site
and the domain controllers that exist at that site.
And then finally, it's important to remember
that replication between sites occurs once over a site link
between 2 bridgehead servers that you can specify
or Active Directory can select for you.
All right, that's a pretty decent lesson.
Thanks for being with me.
And I hope you found it useful.
And I look forward to seeing you in the next lesson.