RE: [ActiveDir] Latency in Group membership

[McCann, Danny]

Title: Message

Hi

 

We only have one site and a mesh topology. Replication is hourly, but even when we update group membership then force replication the latency still exsists. All the DC's are on Gig links!

 

Cheers

 

Danny

 

 

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Carerros, Charles
Sent: 13 July 2005 15:31
To: 'ActiveDir@mail.activedir.org'
Subject: RE: [ActiveDir] Latency in Group membership

Just curious,  how often are you replicating between your sites? And what does your topology look like. 

 

We have noticed this type of issue when we make the changes on one of our DCs that doesn't directly replicate to the one that is being authenticated to.  So we had to wait one hour for one set of replications to take place and then another 3 for the other set.  (We have a really slow link with a DC at one end so we had to do the longer replication time.)

 

Charlie

-----Original Message-----
From: McCann, Danny [mailto:[EMAIL PROTECTED]
Sent: Wednesday, July 13, 2005 9:18 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] Latency in Group membership

Hi

 

There are no apps running on the DC's. The event logs are clean, but there is the occasional directory replication problem (every few days), a single object with "directory busy, will try again later", which will then succeed on the next replication. But they pass all the DCDiag tests.

 

Cheers

 

Danny

 

 

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Al Mulnick
Sent: 13 July 2005 13:18
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] Latency in Group membership

What apps are running on the DC's? Have you checked to be sure that replication is functioning correctly?  Event logs clean?

 

Al

---

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of McCann, Danny
Sent: Wednesday, July 13, 2005 4:33 AM
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] Latency in Group membership

Hi

Recently our domain has began to show some latency in resolving group membership.
Ie When someone is newly added to a group for access to a particular resource it's now taking much longer than was the norm to resolve that security. It's taking anything from 30mins to the next day to resolve itself.

Logging off and back on again to clear the kerberos ticket doesn't (usually) solve the problem.
I've tested AD and monitored some NTDS performance counters and everything appears to be fine.
Network performance is good and there's no great loading on any of the DC's.

I'd be grateful if anyone could help me out with some guidance on where to look next.

Thanks

Danny