Module 6: AD Sites, Replication & Domain Controllers

← Module 5: DNS & DHCP

Module 6 of 8

Module 7: FSMO Roles →

🎯 AD Administration Course · Module 6 of 8

AD Sites, Replication & Domain Controllers

📂 Course: Active Directory Administration
📦 Module: 6 of 8
🎯 Exam: AZ-800
⏱ Read time: ~28 min
AZ-800
AZ-800 Exam Alignment
AZ-800

Configure and manage AD DS replication: Create sites, subnets, and site links; understand the KCC and replication topology; configure RODC; and monitor replication health with repadmin.

  • Know that intra-site replication is automatic, fast, and uncompressed — triggered within seconds of a change
  • Know that inter-site replication is scheduled, compressed, and controlled by site link cost and interval settings
  • Understand what an RODC is and when to deploy it — specifically for branch offices with no physical security
  • Know the repadmin commands for monitoring replication health: repadmin /showrepl, repadmin /replsummary
Exam Tip: AZ-800 tests site link configuration. Know that cost determines which site link is preferred (lower cost = preferred). Know that the KCC (Knowledge Consistency Checker) automatically builds the replication topology — you rarely need to manually create connection objects.
Active Directory sites control how AD DS replication traffic flows between domain controllers at different physical locations. A well-designed site topology ensures that replication is efficient, clients authenticate to the nearest DC, and Group Policy is applied from the closest site. This module covers sites, subnets, site links, replication mechanics, and Read-Only Domain Controllers.

🏢 AD Sites and Subnets

An AD site represents a group of well-connected IP subnets — typically a physical location (office building, campus, data centre). Sites control DC locator behaviour (clients prefer DCs in their own site) and inter-site replication scheduling.

AD Sites and Services › Sites › Subnets › Inter-Site Transports
AD
Active Directory Sites and Services
|
Sites
🏝️ Sites and Services
🏢 Sites
🏠 London-Site
🏠 Manchester-Site
🏠 Default-First-Site-Name
🔌 Subnets
10.0.1.0/24 → London-Site
10.0.2.0/24 → Manchester-Site
🏠 Inter-Site Transports
🔗 IP → DEFAULTIPSITELINK

DEFAULTIPSITELINK Properties
Property Value
Sites included London-Site, Manchester-Site
Cost 100 (default)
Replication interval 180 minutes
Schedule Available 24 hours / all days
ⓘ Lower cost = preferred path. Multiple site links allow cost-based redundant paths between sites.

🔄 Replication — Intra-Site vs Inter-Site

Aspect Intra-Site (same site) Inter-Site (different sites)
Trigger Automatic — within 15 seconds of a change (uses change notification) Scheduled — based on the site link’s replication interval (default: 180 min)
Compression Not compressed — fast LAN, no need Compressed — saves WAN bandwidth
Transport RPC over IP RPC over IP (SMTP no longer supported for AD replication)
Topology builder KCC — builds a ring topology with up to 3 hops between any two DCs ISTG (Inter-Site Topology Generator) — one per site, builds inter-site connection objects
Urgency Some events (account lockout, LSA secret changes) trigger immediate urgent replication No urgent replication — follows schedule

🔐 Read-Only Domain Controllers (RODCs)

An RODC holds a read-only copy of the AD database. Changes cannot be written to an RODC — they are always directed to a writable DC. RODCs are designed for branch offices without adequate physical security.

RODC Feature Description
Password Replication Policy (PRP) Controls which accounts’ passwords are cached on the RODC. Only cached passwords can be used for offline authentication if the WAN is down. Use Allowed RODC Password Replication Group and Denied RODC Password Replication Group.
Administrator Role Separation A local user can be delegated administrator rights on the RODC without being a Domain Admin — so branch staff can manage the local server without domain-wide rights.
Filtered Attribute Set Specific attributes can be excluded from replication to the RODC (e.g. sensitive application attributes), reducing risk if the RODC is stolen.
Unidirectional replication Changes replicate FROM writable DCs TO the RODC. Nothing replicates from RODC to writable DCs.
PowerShell — Sites, Replication & RODC

# Create AD sites
New-ADReplicationSite -Name 'London-Site'
New-ADReplicationSite -Name 'Manchester-Site'

# Create subnets and associate with sites
New-ADReplicationSubnet -Name '10.0.1.0/24' -Site 'London-Site'
New-ADReplicationSubnet -Name '10.0.2.0/24' -Site 'Manchester-Site'

# Create a site link with custom cost and interval
New-ADReplicationSiteLink -Name 'London-Manchester-Link' -SitesIncluded 'London-Site','Manchester-Site' -Cost 50 -ReplicationFrequencyInMinutes 60

# Check replication health
repadmin /showrepl
repadmin /replsummary

# Force immediate replication to all partners
repadmin /syncall DC01 /AdeP

# PowerShell: check for replication failures
Get-ADReplicationFailure -Scope Domain | Format-Table Server,FirstFailureTime,FailureCount,LastError

# Promote a Read-Only Domain Controller
Install-ADDSDomainController `
    -DomainName 'techcareers.local' `
    -SiteName 'Manchester-Site' `
    -ReadOnlyReplica `
    -Credential (Get-Credential) `
    -Force

💡 Best Practices

  • Always create an AD site and subnet for every physical location — without subnet definitions, clients may authenticate against a distant DC over the WAN
  • Set site link cost to reflect relative WAN speed: lower cost = faster / preferred link (e.g. 100Mbps = cost 10, 10Mbps = cost 50, 1Mbps = cost 200)
  • Deploy at least two writable DCs in your hub sites before adding RODCs in branches — RODCs need writable DCs to contact for password validation
  • Configure a specific Allowed Password Replication Group on each RODC — only cache passwords for users who actually log on at that branch
  • Use repadmin /replsummary weekly as a quick health check — it shows largest and oldest replication deltas across all DCs
  • Rename Default-First-Site-Name to something meaningful (e.g. London-HQ-Site) immediately after forest creation

🎓 Interview Q&A

Q: What is the KCC and what does it do?
The Knowledge Consistency Checker (KCC) is a built-in process that runs on every domain controller and automatically builds the AD replication topology. Within a site, the KCC creates connection objects between DCs to form a bidirectional ring topology — ensuring no more than 3 hops between any two DCs. For inter-site replication, the KCC on one DC per site (the ISTG — Inter-Site Topology Generator) creates connection objects across site links. The KCC runs every 15 minutes and self-heals the topology when DCs are added or removed. Administrators rarely need to manually create connection objects.

Q: A branch office RODC was stolen. What steps should you take?
Immediately: (1) Reset all passwords that were cached on the RODC. Run Get-ADDomainControllerPasswordReplicationPolicyUsage -Identity BranchRODC -AuthenticatedAccounts to identify which accounts authenticated against the RODC and had their passwords cached. (2) Force a password reset for each of those accounts. (3) Seize or transfer any FSMO roles from the RODC (RODCs don’t hold FSMO roles — so this step may not be needed). (4) Remove the RODC object from AD and clean up its metadata. (5) Review what objects were in the Allowed Password Replication Group. (6) Consider enabling the Filtered Attribute Set to protect sensitive attributes in future RODC deployments.

Q: Users in the Manchester office are slow to log on and always authenticate against a London DC. Why?
The most likely cause is that the Manchester office’s IP subnet has not been defined in AD Sites and Services, or has not been associated with a Manchester site. When a client’s subnet is not mapped to any site, it defaults to using any available DC — often the first one it finds via DNS, which may be in London. Fix: (1) Create a Manchester site in AD Sites and Services, (2) Create a subnet entry for Manchester’s IP range (e.g. 10.0.2.0/24) and link it to Manchester-Site, (3) Ensure there is at least one DC in the Manchester site. After this, Manchester clients will authenticate against the local DC.

🎯 AZ-800 Mock Test
Module 6 — Sites, Replication & Domain Controllers
5 questions · Scenario-based · Pass mark: 70%

Question 1 of 5

You have two sites: London and Manchester, linked by DEFAULTIPSITELINK with a cost of 100 and a 180-minute interval. You add a second faster link with cost 50 and 60-minute interval. What happens to replication between the sites?

ABoth links carry 50% of replication traffic simultaneously
BReplication continues to use the original 180-minute link; new links require manual activation
CThe KCC prefers the lower-cost link (cost 50) and replicates every 60 minutes; the higher-cost link becomes the failover path
DReplication switches to the new link only if the original link fails

Question 2 of 5

When should you deploy a Read-Only Domain Controller (RODC) instead of a writable DC?

ABranch offices with poor physical security where a stolen DC could compromise the entire domain
BSites where administrators want to allow local users to perform AD writes without domain admin rights
CMain data centres where low replication lag is required
DEnvironments where the WAN link is fast enough for real-time replication

Question 3 of 5

What is the main difference between intra-site and inter-site AD replication?

AIntra-site uses SMTP; inter-site uses RPC
BIntra-site is immediate/uncompressed using change notification; inter-site is scheduled and compressed to reduce WAN bandwidth usage
CIntra-site replication uses KCC; inter-site replication is always manually configured
DInter-site replication uses SSL certificates; intra-site uses Kerberos only

Question 4 of 5

Which repadmin command shows a summary of replication status across all DCs in the domain, including the largest and oldest replication delta?

Arepadmin /showconn
Brepadmin /showrepl
Crepadmin /syncall
Drepadmin /replsummary

Question 5 of 5

An RODC in a branch office is caching passwords for all domain users, including Domain Admins and Service Accounts. Why is this a security risk?

AIf the RODC is stolen, attackers can extract the cached password hashes and crack admin and service account credentials, potentially compromising the entire domain
BRODCs cannot cache more than 100 user passwords — caching all users exceeds this limit
CCaching service account passwords causes replication errors with writable DCs
DDomain Admin passwords cannot be cached on RODCs — the policy prevents this automatically



🔒

This module is locked — Complete Module 5 and pass its mock test to unlock this module.
Complete the quiz above (70%+) to unlock Module 7: FSMO Roles, Trusts & Forest Management