RE: [ActiveDir] AD lag sites and replication

Wed, 31 May 2006 01:00:16 -0700

Title: AD lag sites and replication
Joe,
I thought" (and its a long time since I looked) that you needed to be an enterprise admin to force replication in AD Sites and Services... You can force replication in the domain context in replmon. I guess that this begs another question....
 
1. Are you trying to stop replication in all replication contexts?
 
Dave

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joe
Sent: 31 May 2006 00:27
To: [email protected]
Subject: RE: [ActiveDir] AD lag sites and replication

I am confused by your #2. Are you saying that admins can't force replication outside of the normal replication periods?

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Wade
Sent: Tuesday, May 30, 2006 6:59 AM
To: [email protected]
Subject: RE: [ActiveDir] AD lag sites and replication

Neil,
 
1) If you start setting firewall rules then I am pretty sure you will break things as you will block urgent replication. What happens if some one changes their password and then goes to the home site? What about group membership changes? Do you really want to wait two days before you update these?.
 
2) I don't think that "normal admins" can trigger unscheduled replication changes. Certainly I am a Domain Admin and I can't trigger replication changes on our infrastructure, but it is Windows/2000
 
3) IMHO you would be better worrying about getting things to replicate when they are supposed to rather than things replicating when they shouldn't
 
Dave

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ulf B. Simon-Weidner
Sent: 30 May 2006 11:32
To: [email protected]
Subject: RE: [ActiveDir] AD lag sites and replication

Hi Neil,
 
I'd still go for a firewall with scheduled rules. IMHO there's no such thing as "locked down replication schedules" - as soon as someone is hitting a switch to force replication across sites. And the firewall will help you to assure no client is hitting a lag sites DC.

Gruesse - Sincerely,

Ulf B. Simon-Weidner

  Profile & Publications:   http://mvp.support.microsoft.com/profile="">   
  Weblog: http://msmvps.org/UlfBSimonWeidner
  Website: http://www.windowsserverfaq.org

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED]
Sent: Tuesday, May 30, 2006 10:33 AM
To: [email protected]
Subject: RE: [ActiveDir] AD lag sites and replication

Thanks Ulf.
 
I was hoping to avoid NIC disabling and such like. I was looking for a solution which would enforce the replication schedule between sites, such that an admin could not 'over ride' it.
 
I'd rather handle the situation with procedures and policies than use scripts to disable NICs (or connection objects) at scheduled times :)
 
neil

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ulf B. Simon-Weidner
Sent: 30 May 2006 09:01
To: [email protected]
Subject: RE: [ActiveDir] AD lag sites and replication

You are able to disable the network interfaces, pretty easy with VMWare or Virtual Server since you are able to do it from the host via scripting, bit more painfull if you have to do it from the DC itself since you don't have any remote access when the nic is disabled (you could use a scheduled task which runs netsh to activate / deactivate the interface).
 
Also putting a firewall with scheduled rules in between would work very well, especially since you can block everything but RDP at the no-sync times.
 
As long as you don't exceed the tombstone-lifetime I don't see any reasons why this should not be supported since we are just talking about lag-sites without any memberservers / clients / users who log onto those DCs.

Gruesse - Sincerely,

Ulf B. Simon-Weidner

  Profile & Publications:   http://mvp.support.microsoft.com/profile="">   
  Weblog: http://msmvps.org/UlfBSimonWeidner
  Website: http://www.windowsserverfaq.org

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED]
Sent: Tuesday, May 30, 2006 9:49 AM
To: [email protected]
Subject: [ActiveDir] AD lag sites and replication

I'm looking to implement one or more lag sites, with staggered replication schedules. (i.e. NYC lag replicates tues and thurs, 2-4 am; LON lag replicates mon, wed and fri 2-4 am).

We're concerned that admins can still force replication outside of these hours using repadmin or replmon etc.

Is there a (supported) way to ensure that replication can ONLY occur within the hours described above?

Thanks,
neil




**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. As a public body, the Council may be required to disclose this email, or any response to it, under the Freedom of Information Act 2000, unless the information in it is covered by one of the exemptions in the Act.

If you receive this email in error please notify Stockport e-Services via [EMAIL PROTECTED] and then permanently remove it from your system.

Thank you.

http://www.stockport.gov.uk
**********************************************************************

Reply via email to