How do you ensure domain controllers maintain the latest Active Directory state?
Active Directory (AD) is not a static entity, but rather a dynamic data set -- residing on a domain controller...
within the data center -- which both enforces established rules and tracks the current state of users and systems throughout the network domain. Windows-based networks can accommodate more than one domain controller. Multiple domain controllers may be essential for larger, more complicated or physically segregated networks. And changes in any domain controller instance are ultimately replicated to the other domain controllers within the network. It's a process known as multi-master replication.
However, there is a serious synchronization problem when changes can occur on any domain controller. AD relies on several elements to track changes and to ensure timely synchronization. The two most important elements are update sequence numbers (USNs) and Invocation IDs.
A USN is a 64-bit number that increments every time a change takes place on the domain controller (such as object creation, modification or deletion). The USN never decreases and is always unique, so domain controllers will never use the same USN at the same time. Unique USNs are better than a time stamp because it's almost impossible to keep clocks synchronized or account for latencies between network segments. Once the originating USN is incremented, the changes are replicated to other domain controllers, which will also increment corresponding USNs by the same amount.
Once AD changes are ready to be replicated, it's important to identify all of the domain controllers that must be updated. This uses two elements: globally unique identifiers (GUIDs), which are basically the static "name" of each domain controller, and an Invocation ID, which basically details the current "state" of any AD updates. For example, when a domain controller is restored, the Invocation ID is reset, so the other domain controllers will be sure to send any changes to the restored domain controller since the backup was taken. This is an important wrinkle. If the domain controller is restored improperly, the Invocation ID may not be reset to update the domain controller to match other domain controllers -- resulting in major AD replication problems for the enterprise.
There are other elements involved in AD replication that are used to determine the changes that are needed and that prevent unneeded replication that might consume vital network bandwidth (or even runaway replication cycles), but USNs and Invocation IDs are the most common data elements used to coordinate AD replication between domain controllers.
Dig Deeper on Microsoft Active Directory Design and Administration
Related Q&A from Stephen J. Bigelow
Administrators in charge of keeping antivirus software up to date have a few options to protect their servers. Learn about the methods and services ... Continue Reading
The Office Insider program can benefit organizations that want as much lead time as possible to see what new features Microsoft plans to release for ... Continue Reading
Microsoft offers Windows Defender Antivirus as its native tool to prevent malware attacks. Discover how it works and what advanced protections it ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.