How do you ensure domain controllers maintain the latest Active Directory state?
Active Directory (AD) is not a static entity, but rather a dynamic data set -- residing on a domain controller...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
within the data center -- which both enforces established rules and tracks the current state of users and systems throughout the network domain. Windows-based networks can accommodate more than one domain controller. Multiple domain controllers may be essential for larger, more complicated or physically segregated networks. And changes in any domain controller instance are ultimately replicated to the other domain controllers within the network. It's a process known as multi-master replication.
However, there is a serious synchronization problem when changes can occur on any domain controller. AD relies on several elements to track changes and to ensure timely synchronization. The two most important elements are update sequence numbers (USNs) and Invocation IDs.
A USN is a 64-bit number that increments every time a change takes place on the domain controller (such as object creation, modification or deletion). The USN never decreases and is always unique, so domain controllers will never use the same USN at the same time. Unique USNs are better than a time stamp because it's almost impossible to keep clocks synchronized or account for latencies between network segments. Once the originating USN is incremented, the changes are replicated to other domain controllers, which will also increment corresponding USNs by the same amount.
Once AD changes are ready to be replicated, it's important to identify all of the domain controllers that must be updated. This uses two elements: globally unique identifiers (GUIDs), which are basically the static "name" of each domain controller, and an Invocation ID, which basically details the current "state" of any AD updates. For example, when a domain controller is restored, the Invocation ID is reset, so the other domain controllers will be sure to send any changes to the restored domain controller since the backup was taken. This is an important wrinkle. If the domain controller is restored improperly, the Invocation ID may not be reset to update the domain controller to match other domain controllers -- resulting in major AD replication problems for the enterprise.
There are other elements involved in AD replication that are used to determine the changes that are needed and that prevent unneeded replication that might consume vital network bandwidth (or even runaway replication cycles), but USNs and Invocation IDs are the most common data elements used to coordinate AD replication between domain controllers.
Dig Deeper on Microsoft Active Directory Design and Administration
Related Q&A from Stephen J. Bigelow
One size does not fit all when administrators develop a protection policy for specific applications. Learn about the configuration options in System ...continue reading
Set up and operate a VM network using proven strategies to ensure security and performance. With a little planning, virtualization admins can avoid ...continue reading
Virtual switch security is achieved through a number of features. Virtualization admins can create and enforce policies, lock down MAC addresses and ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.