Active Directory Sites and Replication optimizes network traffic by controlling how and when directory data is replicated between domain controllers across different physical locations.
An AD site represents a set of well-connected IP subnets, typically a physical location with high-speed network connectivity.
Subnets define IP address ranges and must be associated with sites for proper client-DC mapping.
Creating a subnet and assigning it to a site tells AD which physical location that IP range belongs to, so clients on that network authenticate locally.
Listing all subnets confirms every IP range in your organization has a site assignment, preventing random DC selection.
If a subnet moves to a different physical location, reassign it to the correct site without deleting and recreating it.
Site links define the replication paths between sites and control how AD data flows across WAN connections.
Creating a dedicated site link with a lower cost and shorter interval ensures replication happens faster over the high-bandwidth HQ-to-branch connection.
Lowering the cost of a site link makes it the preferred replication path when multiple routes exist between sites.
AD uses different replication strategies depending on whether DCs are in the same or different sites.
The KCC is an automatic process that creates and maintains the replication topology.
When you add or remove DCs, force the KCC to rebuild the replication topology immediately rather than waiting for its 15-minute cycle.
Connection objects represent the replication partnerships that KCC has automatically created between domain controllers.
Filtering for errors-only across all DCs quickly reveals any replication partnerships that are failing.
Bridgehead servers are the designated replication partners for intersite traffic.
Querying the bridgeheadServerListBL attribute shows which DCs are currently acting as bridgehead servers for intersite replication.
Manually designating a preferred bridgehead ensures your most powerful DC handles the intersite replication load instead of leaving it to GUID-based selection.
Site link bridges control whether transitive replication is allowed across site links.
With bridging: NYC can replicate directly to LA via Chicago
Use these tools and techniques to diagnose and resolve replication problems.
The replication summary gives a quick health check across every DC, showing the largest replication delay and failure count for each partner.
For a specific DC, showrepl displays each replication partner, the last successful sync time, and any errors.
When you need changes propagated immediately, syncall forces replication across all DCs including transitive partners.
Checking the replication queue reveals whether changes are backed up waiting to be sent or received.
The PowerShell cmdlet provides structured failure data that can be filtered, sorted, and exported for reporting.
SYSVOL contains Group Policy templates and scripts that must be synchronized across all DCs.
Before migrating from FRS, check whether your domain has already completed the migration to DFS-R by querying the global state.
Forcing AD polling ensures the DFS-R service picks up any recent configuration changes without waiting for the next automatic cycle.
Verifying the SYSVOL share is accessible confirms that Group Policy objects can be served to clients from this DC.
RODCs provide AD authentication in branch offices with limited physical security.
Deploying an RODC to a branch site gives local users fast authentication without storing a writable copy of the AD database at a less-secure location.
The Password Replication Policy controls which user passwords are cached on the RODC. Only cache passwords for users who regularly log on at that branch.
Practice configuring sites, subnets, and replication in both GUI and PowerShell.