RE: [ActiveDir] Site Link Bridging

neil.ruston Wed, 10 May 2006 02:50:29 -0700

Title: RE: Site Link Bridging

Appropriate costs would mitigate this issue. I would not disable bridging in a multi hub topology, unless there were other good reasons to do so.

neil

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ion Gott
Sent: 10 May 2006 00:47
To: [email protected]; [email protected]
Subject: RE: [ActiveDir] Site Link Bridging

The primary reason I have disabled site link bridging in the past has been to prevent domain controllers in spokes with replicating with other dc's in spoke sites that are in another hub site when they should only be replicating with DC's in the hub sites and second with spoke dc's in their own hub.

If for example you had three hub sites and one hub site failed you may want the dc's in the spokes to replicate with one of the other regional hubs rather than the KCC generating replication links with other hubs spoke dc's throughout the environment.

Site link costing of course comes into play here too...

Ion V. Gott
Principal Consultant

CISSP, MCSE + Security/Messaging

From: [EMAIL PROTECTED] on behalf of joe
Sent: Tue 5/9/2006 6:39 AM
To: [email protected]
Subject: RE: [ActiveDir] Site Link Bridging

Having site link bridging should not have resulted in DCs from different sites registering in the same site unless their wasn't full coverage for the domains or if one of the sites didn't have a GC. Something isn't right here.

Not that that might not be a response they heard from an architecture review though, the quality of those reviews/health checks/RAPs and the guidance given at the end vary drammatically in quality based on the analyst involved. I have found in general though the AD folks can't give any good advice on Exchange and the Exchange healthcheck folks can't give very good advice on AD and MSFT doesn't have an all consuming healthcheck that takes all of it into account. So you end up getting a case of one healthcheck pointing at the other for sources of problems. Usually what you see is the AD folks saying everything is fine and the Exchange folks saying AD is in trouble but not being able to point at anything in particular.

joe

O'Reilly Active Directory Third Edition - http://www.joeware.net/win/ad3e.htm

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED]
Sent: Tuesday, May 09, 2006 6:41 AM
To: [email protected]
Subject: [ActiveDir] Site Link Bridging

A friend of a friend when designing a new forest was asked to disable site link bridging (forest wide) based upon the reasoning given below.

I fail to see any connection between the description below and site link bridging.

Does anyone see how these issues could be caused by bridging and furthermore, why the issue would have been resolved by disabling bridging???

neil

PS I don't necessarily believe that MS really did suggest disabling bridging would help - I merely copy/pasted the original thread :)

___________________________
Neil Ruston
Global Technology Infrastructure
Nomura International plc
Telephone: +44 (0) 20 7521 3481

We had an issue where the Domain Controllers in the New York site and New Jersey site were being registered under one site in DNS. This was causing users to authenticate to DC’s over the WAN link as well as Exchange servers using GC’s over the WAN link. This was causing some delays in users logging on as well as outlook being slow using the address book.

Also servers were synching up their time with DC’s in other sites causing w32 time errors at night and during the weekend while backups were running. This caused some servers to have their time offset be 3-5 seconds.

We had Microsoft on-site services evaluate the infrastructure and they recommended that we disable the Site Link Bridging to increase performance of the above issues.

PLEASE READ: The information contained in this email is confidential and

intended for the named recipient(s) only. If you are not an intended

recipient of this email please notify the sender immediately and delete your

copy from your system. You must not copy, distribute or take any further

action in reliance on it. Email is not a secure method of communication and

Nomura International plc ('NIplc') will not, to the extent permitted by law,

accept responsibility or liability for (a) the accuracy or completeness of,

or (b) the presence of any virus, worm or similar malicious or disabling

code in, this message or any attachment(s) to it. If verification of this

email is sought then please request a hard copy. Unless otherwise stated

this email: (1) is not, and should not be treated or relied upon as,

investment research; (2) contains views or opinions that are solely those of

the author and do not necessarily represent those of NIplc; (3) is intended

for informational purposes only and is not a recommendation, solicitation or

offer to buy or sell securities or related financial instruments. NIplc

does not provide investment services to private customers. Authorised and

regulated by the Financial Services Authority. Registered in England

no. 1550505 VAT No. 447 2492 35. Registered Office: 1 St Martin's-le-Grand,

London, EC1A 4NP. A member of the Nomura group of companies.