How do i setup AD site links and Cost

%3CLINGO-SUB%20id%3D%22lingo-sub-3368777%22%20slang%3D%22en-US%22%3EHow%20do%20i%20setup%20AD%20site%20links%20and%20Cost%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3368777%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22AusSupport180_0-1652424162069.jpeg%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F371352i6FE4C455E9146977%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22AusSupport180_0-1652424162069.jpeg%22%20alt%3D%22AusSupport180_0-1652424162069.jpeg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%20class%3D%22%22%3EHi%20AD%20Guys%2C%3C%2FP%3E%3CP%20class%3D%22%22%3EFrance%20Branch%20office%20DC%20died%20and%20We%20have%20set%20the%20London%20DNS%20on%26nbsp%3B%20France%20DHCP%20scopes.%3C%2FP%3E%3CP%20class%3D%22%22%3Eusers%20are%20accessing%20the%20AWS%20file%20servers%20but%20very%20slowly.%3C%2FP%3E%3CP%20class%3D%22%22%3E%26nbsp%3B%3C%2FP%3E%3CP%20class%3D%22%22%3EWhat%20is%20the%20best%20way%20to%20configure%20that%20site%20link%20for%20better%20access%3F%3C%2FP%3E%3CP%20class%3D%22%22%3E%26nbsp%3B%3C%2FP%3E%3CP%20class%3D%22%22%3EDo%20I%20need%20to%20create%20a%20new%20link%20to%20France%E2%80%94AWS%3F%20or%20has%20nothing%20to%20do%20with%20AD%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-3368777%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EActive%20Directory%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EActive%20Directory%20(AD)%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3369982%22%20slang%3D%22en-US%22%3ERe%3A%20How%20do%20i%20setup%20AD%20site%20links%20and%20Cost%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3369982%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F772771%22%20target%3D%22_blank%22%3E%40AusSupport180%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20short%20answer%20is%20%22nothing%20to%20do%20with%20AD%22.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThere's%20stuff%20you%20can%20do%20to%20influence%20domain%20controller%20selection%20while%20France%20is%20brought%20back%20online%20(which%20is%20only%20worth%20talking%20about%20if%20France%20will%20be%20offline%20for%20some%20time)%2C%20but%20for%20files%2C%20this%20only%20relates%20(normally)%20to%20SYSVOL%20content%2C%20which%20in%20principle%20should%20only%20in%20turn%20relate%20to%20things%20like%20group%20policy%20files%20and%20such.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EGiven%20people%20shouldn't%20be%20storing%20%22normal%20work%22%20files%20on%20the%20SYSVOL%2C%20this%20is%20why%20AD%20shouldn't%20have%20any%20bearing%20on%20accessing%20the%20AWS-UK%20files.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECheers%2C%3C%2FP%3E%3CP%3ELain%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3373737%22%20slang%3D%22en-US%22%3ERe%3A%20How%20do%20i%20setup%20AD%20site%20links%20and%20Cost%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3373737%22%20slang%3D%22en-US%22%3EThanks%2C%20Lain%2C%3CBR%20%2F%3E%3CBR%20%2F%3ENoticed%20those%20site%20link%20costs%20are%20set%20up%20like%20500%20and%20225%20will%20that%20makes%20any%20effect%3F%20i%20have%2040-50%20sites%20and%20all%20are%20set%20up%20at%20different%20costs.%20also%2C%20noticed%20that%20sites%20are%20connected%20to%20the%20default%20site%20links%3F%20how%20do%20we%20clean%20up%20those%20messes%20properly%20to%20make%20the%20replication%20and%20healthy%20environment%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3373854%22%20slang%3D%22en-US%22%3ERe%3A%20How%20do%20i%20setup%20AD%20site%20links%20and%20Cost%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3373854%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F772771%22%20target%3D%22_blank%22%3E%40AusSupport180%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20actual%20siteLink%20cost%20values%20aren't%20important%20on%20their%20own.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMy%20best%20guess%20is%20that%20%22large%22%20(large%20being%20subjective)%20values%20were%20used%20between%20countries%20to%20promote%20regionally-local%20sites%20ahead%20of%20crossing%20international%20boundaries%2C%20in%20which%20case%20those%20large%20values%20make%20total%20sense.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20matters%20is%20their%20relative%20weighting%20compared%20to%20other%20siteLink%20objects%20coming%20from%20the%20same%20site%20(if%20there%20are%20multiple%2C%20that%20is.)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20cost%20attribute%20is%20an%20INTEGER%20that%20has%20no%20upper%20or%20lower%20limit%20bounds%20meaning%20it%20can%20accept%20ridiculously%20large%20values%2C%20so%20there's%20really%20nothing%20to%20worry%20about.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CUL%3E%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fwin32%2Fadschema%2Fa-cost%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3ECost%20attribute%20-%20Win32%20apps%20%7C%20Microsoft%20Docs%3C%2FA%3E%3C%2FLI%3E%3C%2FUL%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThere%20are%20other%20influential%20control%20points%20outside%20of%20the%20siteLink%20cost%20value%2C%20too%2C%20such%20as%20whether%20automatic%20site%20bridging%20has%20been%20left%20enabled%20(uncommon%20in%20larger%20environments%20but%20definitely%20possible)%20and%20whether%20siteLinkBridge%20objects%20have%20been%20defined%20(rarely%20used%2C%20which%20is%20sad%20because%20they're%20incredibly%20useful%20from%20a%20disaster%20recovery%20perspective%20-%20which%20is%20exactly%20the%20situation%20you're%20now%20in.)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CUL%3E%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows-server%2Fidentity%2Fad-ds%2Fplan%2Fcreating-a-site-link-bridge-design%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3ECreating%20a%20Site%20Link%20Bridge%20Design%20%7C%20Microsoft%20Docs%3C%2FA%3E%3C%2FLI%3E%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows-server%2Fidentity%2Fad-ds%2Fget-started%2Freplication%2Factive-directory-replication-concepts%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EActive%20Directory%20Replication%20Concepts%20%7C%20Microsoft%20Docs%3C%2FA%3E%3C%2FLI%3E%3C%2FUL%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOne%20thing%20to%20watch%20out%20for%20is%20where%20the%20site%20design%20isn't%20done%20very%20well%20and%20lots%20of%20inappropriately-configured%20perimeter%20firewalls%20exist.%20The%20outcome%20from%20this%20kind%20of%20misconfiguration%20is%20unhappy%20users%20as%20authentication%20functions%20frequently%20time%20out%20as%20their%20client%20randomly%20tries%20to%20talk%20to%20domain%20controllers%20blocked%20by%20intermediate%20firewalls.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20this%20is%20happening%2C%20you%20can%20run%20the%20following%20statement%20in%20PowerShell%20on%20one%20of%20the%20affected%20clients%20-%20assuming%20they're%20Windows%20domain-joined%20clients%20-%20to%20get%20a%20brief%20overview%20of%20what%20that%20client%20believes%20it%20are%20the%20next%20closest%20(i.e.%20value%20in%20%22AdjacentSites%22.)%20You%20do%20not%20need%20administrative%20rights%20to%20do%20this.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-powershell%22%3E%3CCODE%3E%5BSystem.DirectoryServices.ActiveDirectory.ActiveDirectorySite%5D%3A%3AGetComputerSite()%20%7C%20Select-Object%20-Property%20Name%2C%20AdjacentSites%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EProper%20site%20design%20is%20a%20big%20topic%2C%20filled%20with%20%22it%20depends%22-style%20answers.%20But%20for%20your%20file%20server%20issue%2C%20it's%20mostly%20unrelated%20-%20the%20obvious%20overlap%20being%20authentication%20(which%20would%20mostly%20incur%20infrequent%2C%20up-front%20overhead%20for%20the%20France%20clients%20when%20accessing%20a%20new%20file%20server%20or%20their%20current%20Kerberos%20ticket%20expires%2C%20etc.)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EGetting%20back%20to%20your%20file%20server%20situation.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFile%20servers%20that%20use%20DFS-N%20to%20point%20to%20underlying%20hosts%20in%20different%20locations%20will%20still%20continue%20to%20work%2C%20since%20clients%20choose%20what%20they%20think%20is%20the%20most%20appropriate%20server%20based%20on%20data%20stored%20in%20Active%20Directory%2C%20which%20you%20don't%20lose%20just%20because%20one%20domain%20controller%20disappeared.%20The%20pain%20point%20for%20the%20clients%20is%20that%20they%20can't%20query%20a%20local%20domain%20controller%20to%20get%20that%20information%3A%20it%20has%20to%20come%20from%20another%20domain%20controller%20elsewhere.%20But%2C%20since%20the%20data%20does%20still%20exist%2C%20they%20will%20arrive%20at%20the%20same%20conclusion%20as%20when%20the%20local%20domain%20controller%20existed.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%20long%20as%20the%20local%20DFS-N%20target%20is%20still%20working%2C%20the%20user%20might%20experience%20a%20longer%20time%20in%20opening%20the%20file%20while%20the%20local%20domain%20controller%20is%20offline%2C%20but%20once%20opened%20should%20perform%20normally.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAs%20my%20previous%20post%20alluded%20though%20(via%20the%20SYSVOL%20comment%2C%20but%20it%20could%20be%20any%20other%20DFS-N%20namespace%20using%20the%20domain%20controllers%20as%20a%20target)%2C%20this%20is%20assuming%20the%20files%20don't%20live%20on%20the%20domain%20controllers%20themselves%20(which%20they%20shouldn't.)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHowever%2C%20the%20understanding%20I%20got%20from%20your%20original%20post%20is%20the%20file%20servers%20only%20live%20exclusively%20in%20AWS-London%2C%20in%20which%20case%20the%20DFS-N%20points%20above%2C%20while%20interesting%2C%20would%20have%20nothing%20to%20do%20with%20your%20current%20domain%20controller%20issue%20in%20France.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECheers%2C%3C%2FP%3E%3CP%3ELain%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

AusSupport180_0-1652424162069.jpeg

Hi AD Guys,

France Branch office DC died and We have set the London DNS on  France DHCP scopes.

users are accessing the AWS file servers but very slowly.

 

What is the best way to configure that site link for better access?

 

Do I need to create a new link to France—AWS? or has nothing to do with AD?

 

3 Replies

@AusSupport180 

 

The short answer is "nothing to do with AD".

 

There's stuff you can do to influence domain controller selection while France is brought back online (which is only worth talking about if France will be offline for some time), but for files, this only relates (normally) to SYSVOL content, which in principle should only in turn relate to things like group policy files and such.

 

Given people shouldn't be storing "normal work" files on the SYSVOL, this is why AD shouldn't have any bearing on accessing the AWS-UK files.

 

Cheers,

Lain

Thanks, Lain,

Noticed those site link costs are set up like 500 and 225 will that makes any effect? i have 40-50 sites and all are set up at different costs. also, noticed that sites are connected to the default site links? how do we clean up those messes properly to make the replication and healthy environment?

@AusSupport180 

 

The actual siteLink cost values aren't important on their own.

 

My best guess is that "large" (large being subjective) values were used between countries to promote regionally-local sites ahead of crossing international boundaries, in which case those large values make total sense.

 

What matters is their relative weighting compared to other siteLink objects coming from the same site (if there are multiple, that is.)

 

The cost attribute is an INTEGER that has no upper or lower limit bounds meaning it can accept ridiculously large values, so there's really nothing to worry about.

 

 

There are other influential control points outside of the siteLink cost value, too, such as whether automatic site bridging has been left enabled (uncommon in larger environments but definitely possible) and whether siteLinkBridge objects have been defined (rarely used, which is sad because they're incredibly useful from a disaster recovery perspective - which is exactly the situation you're now in.)

 

 

One thing to watch out for is where the site design isn't done very well and lots of inappropriately-configured perimeter firewalls exist. The outcome from this kind of misconfiguration is unhappy users as authentication functions frequently time out as their client randomly tries to talk to domain controllers blocked by intermediate firewalls.

 

If this is happening, you can run the following statement in PowerShell on one of the affected clients - assuming they're Windows domain-joined clients - to get a brief overview of what that client believes it are the next closest (i.e. value in "AdjacentSites".) You do not need administrative rights to do this.

 

[System.DirectoryServices.ActiveDirectory.ActiveDirectorySite]::GetComputerSite() | Select-Object -Property Name, AdjacentSites

 

Proper site design is a big topic, filled with "it depends"-style answers. But for your file server issue, it's mostly unrelated - the obvious overlap being authentication (which would mostly incur infrequent, up-front overhead for the France clients when accessing a new file server or their current Kerberos ticket expires, etc.)

 

Getting back to your file server situation.

 

File servers that use DFS-N to point to underlying hosts in different locations will still continue to work, since clients choose what they think is the most appropriate server based on data stored in Active Directory, which you don't lose just because one domain controller disappeared. The pain point for the clients is that they can't query a local domain controller to get that information: it has to come from another domain controller elsewhere. But, since the data does still exist, they will arrive at the same conclusion as when the local domain controller existed.

 

So long as the local DFS-N target is still working, the user might experience a longer time in opening the file while the local domain controller is offline, but once opened should perform normally.

 

As my previous post alluded though (via the SYSVOL comment, but it could be any other DFS-N namespace using the domain controllers as a target), this is assuming the files don't live on the domain controllers themselves (which they shouldn't.)

 

However, the understanding I got from your original post is the file servers only live exclusively in AWS-London, in which case the DFS-N points above, while interesting, would have nothing to do with your current domain controller issue in France.

 

Cheers,

Lain