How do you ensure domain controllers maintain the latest Active Directory state?
Active Directory (AD) is not a static entity, but rather a dynamic data set -- residing on a domain controller...
within the data center -- which both enforces established rules and tracks the current state of users and systems throughout the network domain. Windows-based networks can accommodate more than one domain controller. Multiple domain controllers may be essential for larger, more complicated or physically segregated networks. And changes in any domain controller instance are ultimately replicated to the other domain controllers within the network. It's a process known as multi-master replication.
However, there is a serious synchronization problem when changes can occur on any domain controller. AD relies on several elements to track changes and to ensure timely synchronization. The two most important elements are update sequence numbers (USNs) and Invocation IDs.
A USN is a 64-bit number that increments every time a change takes place on the domain controller (such as object creation, modification or deletion). The USN never decreases and is always unique, so domain controllers will never use the same USN at the same time. Unique USNs are better than a time stamp because it's almost impossible to keep clocks synchronized or account for latencies between network segments. Once the originating USN is incremented, the changes are replicated to other domain controllers, which will also increment corresponding USNs by the same amount.
Once AD changes are ready to be replicated, it's important to identify all of the domain controllers that must be updated. This uses two elements: globally unique identifiers (GUIDs), which are basically the static "name" of each domain controller, and an Invocation ID, which basically details the current "state" of any AD updates. For example, when a domain controller is restored, the Invocation ID is reset, so the other domain controllers will be sure to send any changes to the restored domain controller since the backup was taken. This is an important wrinkle. If the domain controller is restored improperly, the Invocation ID may not be reset to update the domain controller to match other domain controllers -- resulting in major AD replication problems for the enterprise.
There are other elements involved in AD replication that are used to determine the changes that are needed and that prevent unneeded replication that might consume vital network bandwidth (or even runaway replication cycles), but USNs and Invocation IDs are the most common data elements used to coordinate AD replication between domain controllers.
Related Q&A from Stephen J. Bigelow
Is it better to approach a potential Windows Server 2016 upgrade using in-house staff, or should we seek the help of consultants?continue reading
Companies exploring Windows Server 2016 wonder how disruptive upgrading will be. The first step to a pain-free move is to get IT teams up to speed.continue reading
Amazon Elastic File System is one of a handful of choices for data storage. What are its strengths and weaknesses compared to other storage services?continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.