⌚ About 2 min read

Active Directory Intermediate. 15-30 min

This BAOI guide provides a structured method for checking active sites and services, without multiplying unnecessary changes.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

1

Set perimeter

Identify the equipment, service, affected users and start time.
2

Collect Elements

Record the exact messages, logs and useful settings.
3

Test methodically

Start with the basic dependencies before the application components.
4

Apply correction

Change only the identified parameter or component.
5

Validate

Rewrite the full scenario and document the result.

Commands utiles

nltest /dsgetsite

nltest /dsgetdc:domain.local

À retenir

Keep the initial values for a backwards.
Avoid multiple simultaneous changes.
Compare with a functional configuration when possible.

Technical deep dive

AD replication: global health, partner and topology

Technical checkpoints

repadmin /replsummary gives a global view; repadmin /showrepl shows partner and last error per partition.
Sites/Subnets determine site placement and influence replication partners/costs.
DNS, time, RPC and secure channel can cause replication errors before AD itself is the root cause.

Replication view

Start with the summary then drill into only the failing DC/partition.

repadmin /replsummary
repadmin /showrepl * /errorsonly
dcdiag /test:replications

Topic-specific pitfalls

Forcing /syncall everywhere can multiply errors and does not fix a network/DNS root cause.
A missing AD subnet can send clients to a remote DC without an obvious replication error.

How to validate

All expected DCs replicate without recent errors and latency remains within the normal window.
Client subnets map to the correct site and DC discovery reflects that topology.

Operational context

Active Directory Sites and Services should map real IP subnets to sites so clients select nearby domain controllers and replication follows the intended topology. Validate client site discovery, subnet objects, DC placement and replication links together.

Step-by-step checks

From representative clients in each network, determine the Active Directory site they currently discover and compare it with the expected physical/logical site.
Review subnet objects and masks for gaps, overlaps or stale networks, and confirm each production subnet maps to the intended site.
Verify domain-controller server objects are located in the correct sites and inspect the generated replication connections and site links.
Check replication health and DNS/DC locator behavior before changing site-link cost or schedule values.

Useful verification commands

Use commands only on systems you administer and capture the read-only output before making a configuration change.

nltest /dsgetsite

nltest /dsgetdc:example.com

Get-ADReplicationSite -Filter *

repadmin /replsummary

How to validate the result

Clients from each tested subnet must discover the intended site/DC and domain controllers must replicate successfully through the expected topology without unexplained cross-site selection.

Evidence to keep

Keep tested client IP/subnet, discovered site, selected DC, subnet-to-site mapping, site-link configuration and replication summary.

Frequently asked question

Why does a client use a domain controller in another location?

A missing or incorrect subnet-to-site mapping is a common cause, but DC availability, DNS/DC locator data and replication also need to be checked before changing topology.

Related BAOI resources: IT tools · procedures · IT dictionary.