Advice on Sites and Subnets

---

Hello,

my company is opening a branch office in the same town as the HQ is located and I am wondering what the best option would be to set up the AD at the second site.

The connection between both offices will be a 1 Gbit/s MPLS, only in the first weeks it will be a 500Mbit/ 50 Mbit down/ up solution, as the IPS can not deliver as promised.. anyway..

All services (mail, FTP, file-server etc.) will stay in the HQ.

I obviously will set up a DC at the branch office, but now I struggle what the best option would be:

• shall I just connect the DC to the existing Domain?
• shall I create a new site? And how would I proceed here? First add the new DC and than put it into the new site?
• I guess I have to add the new subnet from the branch office…

It would be great if someone could advice me on what steps I have to do in which order.

So far I just added a new DC when it was in the same location and subnet..

It would be great if you could guide me on which videos / courses I should watch.

Best,
s.

Dang ISP's, always promising what they can't deliver, lol.

I would suggest creating a second site in the same domain. Sites are beneficial when you need to localize services and control replication traffic.

I would start by, if you haven't already, renaming the default-first-site-name and the defaultipsitelink to something meaningful.

In the AD Sites and Services console, do the following:

• Create the second site for your branch office.
• Create your subnet objects, associating them with their appropriate sites.
• Since you've already set up the second DC, it should be listed under the first site. Right-click and move the second DC to the new site.

Then physically move the DC to the new branch office.

Since most of your services are in the HQ site,this traffic will still have to cross the WAN, but logon traffic and GPO processing wont have to cross the WAN unless you have a DC failure at the branch office. I would also recommend making the branch office DC a Global Catalog server. (Right-click NTDS settings > Properties > check Global Catalog) Even though you are a single domain, AD searches still generate traffic to the GC. Also makes it easier if you add additional domains later.

Then monitor your traffic and bandwidth utilization. By default, AD will replicate between sites every 180 minutes. This will minimize the impact of replication traffic, but also means a greater latency for changes (you hire a new user at the branch office, you create their account on the HQ DC, the DC at the branch office wont know about the account for up to three hours) Adjust the replication interval and schedule on the properties of the site link to meet your needs.

Hope this helps and thanks for watching!

Dang Mike!
With your response lol.

Shifty,
I agree with Mike & since he outlined the steps so well, I'm not sure you will need the show references. If you do want to go back and watch then I would recommend either server 2012 or 2016 as the steps should be the same. Good luck with your design :)

Kindly,
Cherokee

@mike-rodrick Hi, thanks for the answer. I would love to clarify some steps.

I did not set up the new DC yet, as the Subnet in the HQ is different and from all I have learned so far I remember that changing the IP of a DC is a massive pain. Did this change?

If not, I will set up the new DC in the branch office and connect via the VPN. This should work, right? And don´t I have to create a new subnet? And are Site-Links needed?

I guess I should watch the videos... I just do not want to see all of it, just the bit I need. :-)

Cheers.

Shifty,

Take a look at this pots, as it goes through the steps involved and references all of the various supporting technologies that will help you make sense of it all.

https://social.technet.microsoft.com/Forums/windowsserver/en-US/30d782a5-0528-4332-9011-8fd0bc557321/multi-site-ad-design?forum=winserverDS

Hey @shifty ,

You are correct, I would not recommend changing the IP address of the DC of you can avoid it ;) I was thinking you would set it up with the planned IP, and do some temp routing. Setting it up at the branch office and connecting via VPN will work fine.

You will need to create at least one new subnet, for the branch office. I think you are aware, but just to make sure, Sites are defined by subnets, So you will need at least two, one for HQ and one for the branch office.

By default, you will have one site (default-first-site-name) and no subnet objects. When you set up the branch office site, you will need to make a subnet object representing the branch office, and a subnet object for HQ. When you create the new subnet, it will ask you what site the subnet belongs to.

Site links are needed. They define where the Inter-site Topology Generator (ISTG) is allowed to create replication links.. When you create a new site, you have to choose a site link (OK button is greyed out until you do) With two sites, you can just use the DEFAULTIPSITELINK, Your default site should already be in the defaultipsitelink, just add your new branch office site to the same site link, and the. ISTG and the Knowledge Consistency Checker (KCC) will create a replication link between the domain controllers.

Here are a couple of pics to help visualize:

https://www.dropbox.com/s/c16huzpw7mx6mv2/siteDiagram.png?dl=0

https://www.dropbox.com/s/rll29hq5v2r4zfy/siteSnippit.PNG?dl=0

Hi @Mike-Rodrick ,

happy new year!

Thanks a ton for the help so far. Let me summarise what I understood and if you could correct me if I got something completely wrong let me know:

Scenario assumes a running VPN between branch & HQ.

At the HQ:

1. NO adprep is needed anymore, as I will add a 2012 Server which does this automatically
2. Rename the default-first-site-name and the defaultipsitelink to something meaningful
3. Create the second site for branch office.
4. Create subnet object and associate them with their appropriate sites.

At the branch:

1. Bring the 2012R2 Server into the new location
2. Give it a static IP.
3. Join the Domain
4. Install Domain Role
5. Promote Server to Domain Controller
   • Keep DNS & GC boxes ticked.
   • Choose Branch Offie Site!
   • Finish Promotion
6. Install DHCP Role & Configure

This should be pretty much it, right?

No the good and the bad part about ITproTV. You learn a lot more, but also some more questions pop up. :-)

a: Would it be better to do the adprep beforehand? Even if the new DC would do it? Especially because in the beginning the VPN won’t be the fastest? And if yes, is adprep in any form interruptive for the existing Domain? Or could I do this during working hours?

b: Would you recommend IFM for the new DC? Or should the internet connection be enough. 350 User / 400 Machines

Once again, thanks

s.

Edit: One more question: In Default there is no subnet linked to the first-site. I now will add my second site and add a subnet to it. Do I have to add subnets to the first-site? Or can I leave it without specific subnets and assumes it is every net beside the configured net for the second site. (I hope you understand what I want to say.. I am a non native speaker. :-) )

Hey @shifty,

Happy New Year! It does seem like the more you learn, the more questions you have, but that's why we are here, we love questions!

Your English is excellent! I would have never known you were not a native speaker if you hadn't said something :)

Your steps look correct to me, I think you are ready!

a) For adprep, two questions for you. What operating system is your current DC running? How big is your AD database (ntds.dit)? According to Microsoft, if your database is larger than 100GB, adprep may cause high CPU utilization by LSASS and high disk utilization from the writing of indexes. This would affect your existing DC, but no impact to network performance. It would also cause additional replication traffic, but since you only have one DC currently, this wont apply to you. Assuming your database isn't nearly that large, I would probably let adprep run automatically during the promotion of the new DC. I would wait for the morning rush of logon traffic to subside, ensure that the VPN is connected and you can ping the current DC by name, and start the process. You will be notified if there are any problems with the adprep process.

b) I would recommend using the IFM option, since you are going to the new site to set up the new DC anyway. Easy enough to create the IFM media while you are at HQ. While adprep won't generate network traffic, the initial database replication will. I think your bandwidth would be sufficient, but since IFM is so easy to do, why not?

c) You will need to create a subnet for the HQ site. When you only have one site, subnets don't matter, everything is in the only site. Once you start defining sites, you need at least one subnet object for each site. If a client has an IP address that is not part of your site design, AD won't be able to determine what site the client is in. So a client in HQ could have there logon traffic, etc sent to the DC at the branch office. You could define a catch-all subnet for HQ site, but these add unnecessary complexity and can lead to problems down the road. If you want more information on a catch-all site, let me know.

Keep me posted on your progress, and of course ask if any more questions come up!

Hey @Mike-Rodrick,

a) current DCs are running 2008R2, we have two. ntds.dit is 38MB, so we are some bits and bytes away from 100GB. So I will let the new DC run the adprep. This is a bit of the spooky part for me. Is there any chance of messing up my existing AD or is this so rock solid that everything should run fine?

b) will do this. Thanks.

c) all already set up all the subnets according to our network. This should be fine.

Once again thanks for your advice, very appreciated!

Hey @shifty ,

I don't think it will break your current AD setup, but I can't guarantee that. Microsoft recommends "making a system state backup of the Schema master and at least one other domain controller from each domain in the forest." The only failures I've ever seen are permission issues (account used to run adprep must be in the domain admins, enterprise admins, and schema admins groups) or connectivity issues (cannot contact schema master) or replication issues (cannot verify successful replication on schema master). These errors occur when adprep is running tests, before it changes anything.

That being said, there is nothing wrong with running it manually. Especially if it gives you peace of mind and reduces your stress levels :) Plus it's a great experience, like you are pulling back the curtain and seeing the magic behind the scenes,, lol.

Are you familiar with the process of running adprep? You'll need to run /forestprep, /domainprep, and /gpprep (maybe). There also some new parameters, like /wssg, which returns an expanded set of exit codes, instead of just 0 (Success) and 1 (Failure).

Here is a link to a great Technet article. It has steps to prepare for each command, and how to verify they completed successfully before running the next command.

@Mike-Rodrick I am afraid you forgot the link. :-)

I will do everything on sunday and let you know.

@shifty

Oops!

Here you go:

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd464018(v=ws.10)

@Mike-Rodrick Thanks for that link, that was very helpful.

Everything went perfect and no big problems so far.
Learnt a ton about the whole sites and subnets stuff, bridgeheads and so on.

Once again, thanks a lot!