Learn Active Directory - Active Directory Physical Structure

#Introduction

In episode 2, you designed AD's logical structure — forests, domains, and OUs that represent your organization. Now it's the turn of the side that's often forgotten until the network starts slowing down: the physical structure. The physical structure answers real questions: which office gets a domain controller, how data replicates between offices, and how clients find the nearest domain controller.

Here's an analogy: the logical structure is the organizational chart — who reports to whom. The physical structure is the building layout and delivery routes — where the offices are, which roads are used, and which routes are cheaper. The two can be very different and still work together.

#Sites

A site is a collection of networks connected by fast, cheap links — usually at the same physical location, such as one office or one floor. This definition is governed by two things: connectivity (bandwidth and latency) and subnets.

Two main functions of a site:

• Directing clients to the nearest domain controller: when a user logs in, the client looks for a DC in its own site first, not a DC overseas. This is the main reason logins stay fast in branch offices.
• Governing replication: changes replicate aggressively within a site and more conservatively between sites.

When AD is installed, the first site, named Default-First-Site-Name, is created automatically. For a multi-location lab, you'll rename it or add new sites.

#Subnets

A subnet is an IP range grouping computers in one network area, e.g. 192.168.10.0/24. Each site is mapped to one or more subnets. When a client logs in, AD reads the client's IP address, matches it to a subnet, then determines the client's site — and from there finds the nearest DC.

This mapping is like a postal code: once you know the address, you know the area. Subnets define AD sites' "postal codes", so make sure every subnet with clients or servers is mapped to the correct site. An unmapped subnet makes clients appear to be in the default site — which often means a distant DC.

#Site Links

A site link is a bridge connecting two or more sites and defining the characteristics of the connection between them: cost, schedule, and replication interval.

• Cost: a number indicating how "expensive" a route is. A lower cost means the route is preferred.
• Schedule: the hours when replication is allowed to run, e.g. outside business hours for expensive links.
• Replication interval: how often replication is attempted, default 180 minutes for inter-site.

Site links are an important design decision: you tell AD which routes are cheap and fast, so AD can pick the most sensible replication path.

#Domain Controller Placement

DC placement is determined by client needs at each location:

• Every site with active users needs at least one DC. Otherwise, users in that site log on to a DC in another site over an expensive, slow link.
• Hub sites can have multiple DCs for redundancy and load balancing — never rely on a single DC.
• Small branch offices can use an RODC (Read-Only Domain Controller): a read-only database that reduces security risk in locations with low physical security.
• Global Catalog placement: place a GC in sites that need cross-domain logon or global searches; without a GC, logon can fail.

DC placement is a cost trade-off: adding a DC speeds up logins but adds cost and replication. Having a DC in a site also means that site must be accounted for in the replication topology.

#Intra-site vs Inter-site Replication

AD uses multi-master replication: all DCs can accept changes. But how changes propagate differs by location:

Changes within a site spread almost instantly. Between sites, AD "banks" changes and sends them per schedule and interval — it's normal for a user change at headquarters to only show up at a branch a few minutes later.

#KCC and the Replication Topology

The replication topology (who replicates to whom) is not created manually — it's computed automatically by the Knowledge Consistency Checker (KCC), a process running on every DC. The KCC builds a replication topology in a ring shape within a site, and determines bridgehead servers for inter-site — DCs that act as the "portal" for replication data in and out of a site.

The KCC periodically re-evaluates the topology and fixes it automatically when a new DC appears or a site link changes. You can force a re-evaluation with repadmin:

repadmin /kcc

repadmin /showrepl

If replication has problems, repadmin /showrepl is the first diagnostic tool you open — it shows replication connections, partners, and the last error per connection.

#Site Link Cost and Configuration

Cost determines which replication path is chosen. The lower the cost, the more preferred the route. When several routes reach the same site, AD picks the path with the lowest total cost — just like a GPS picks the cheapest route. A direct route (low cost) beats a roundabout route (high cost).

Physical configuration can be done from the Active Directory Sites and Services GUI, or with PowerShell:

New-ADReplicationSite -Name "Jakarta"
New-ADReplicationSite -Name "Bandung"
New-ADReplicationSubnet -Name "192.168.10.0/24" -Site "Jakarta"
New-ADReplicationSubnet -Name "192.168.20.0/24" -Site "Bandung"

New-ADReplicationSiteLink -Name "Jakarta-Bandung" -SitesIncluded "Jakarta","Bandung" -Cost 100

With the configuration above, clients on the 192.168.20.0/24 subnet will choose a DC in the Bandung site, and the Jakarta–Bandung DCs replicate over a site link with cost 100 on schedule.

#Conclusion

In episode 3 you understand AD's physical structure: sites as groups of fast networks, subnets as IP mapping, site links as bridges with cost and schedule, DC placement as a trade-off between cost and login speed, and the KCC automatically building the replication topology.

Key takeaways:

• Sites determine which DC serves clients and how replication runs.
• Every subnet with active clients must be mapped to the correct site.
• Intra-site replication is fast and unscheduled; inter-site is slow, scheduled, and compressed.
• The KCC builds the topology automatically; repadmin /kcc and /showrepl are its key tools.

In the next episode, we discuss the component most often blamed when AD misbehaves: DNS integration with Active Directory — why AD is completely dependent on DNS, how SRV records let clients find domain controllers, and how to troubleshoot DNS properly. This is material that will save you countless times!