Link Cost Question

Question

Hello!
apologies for my bad English
Have read through different sites and services links and got stuck with few questions - I have recently taken over AD role from previous admin
our setup below please :
We have 4 physical sites
Dusseldorf, cologne, Frankfurt and nuremberg . Each of these sites have 1 Domain controller each and each site has 500 users .
( Dusseldorf near site is Cologne )
(Cologne near site is Frankfurt )
(Frankfurt near site is Nuremberg)
BASL is enabled and all 4 sites have netework connectivity.
There is only one site link with all 4 sites into the site link with site link cost 100 , when we did a DR activity , we found that
when Dusseldorf site was shutdown - No IP connectivity, clients were authenticating to Nuremberg rather cologne
and when started analyzing the behavior , I read through Ace fekay blog post
http://blogs.msmvps.com/acefekay/2013/02/24/ad-site-design-and-auto-site-link-bridging-or-bridge-all-site-links-basl/
I have two questions
^^ DO I need to remove 4 sites from site link and configure , 3 site links ? assuming one site has complete AD replica and other sites replicate from main site ?
^^ clients DNS on dusseldorf is configured with itself as primary and cologne site as secondary , when client queries the DNS LDAP for site specific records, will DNS check for site link cost ?
Eg: in the event of site failure
      - I restart the client
      - client in Dusseldorf queries primary DNS till the timeout and then it will query secondary DNS which is pointed to Cologne
      - Secondary DNS will return list of DC's from _LDAP._TCP.dc._msdcs.domainname
      - client sends the ping to dusseldorf DC and gets no result, but receives reply from all other 3 site DC's and one of the DC  will refer client to particular site based on its IP subnet
         < does DC checks site cost before assigning site to subnet or site cost is only considered during replication ?

Answer 1

Just seeing this now. I agree with Paul's assessment and recommendations.
Just to touch base on the issue, you stated:
"( Dusseldorf near site is Cologne )
(Cologne near site is Frankfurt )
(Frankfurt near site is Nuremberg)"
"[...] when Dusseldorf site was shutdown - No IP connectivity, clients were authenticating to Nuremberg rather cologne."
I assume that you mean the DC in Dusseldorf was shutdown for the DR test. I see that you want the client to authenticate to Cologne. However, I'm not sure what you mean by "nearest" site, since AD can't tell how far a site is, whether a different subnet
locally or in another town, but the clients will use a number of things to failover querying for another DCs. Part of it is that if an optimal DC can't be located in its own site (as you've already probably read in Paul's KB link), it will look elsewhere,
but how does it do that? There are a number of mechanisms in place, and one of which is netmask ordering - using the longest subnet bits first. So the Dusseldorf and Nuremberg site subnets bits must be closest compared to Cologne. Here's a couple of good
discussions that will explain this more:
Good summary of Subnet Priortization, Netmask Ordering, and AD Sites, which is used first, etc.
Using Round Robin and Netmask Ordering for load balancing
http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/0181af1e-be4d-4871-99d3-e7ea5d0ecf38/
Technet Thread - DNS issue : DHCP relay + VLANs + multiple AD Sites (Heavily discusses subnet prioritization and subnet bits)
http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/ea03c013-7484-4a24-96be-d95219b69b3f/
And needless to say, there will be a period of time that the local machines in a site that have the DC cached. Now depending on the directory enabled apps installed (such as Outlook), will determine which ones are more tolerant than others. Outlook isn't
too tolerant. Restarting Outlook will make it pickup another DC for its DSProxy.
The operating system itself has its quirks with this, too.
If one DC or DNS goes down, does a client logon to another DC or use the other DNS server in the NIC?
http://msmvps.com/blogs/acefekay/archive/2009/11/29/dns-wins-netbios-amp-the-client-side-resolver-browser-service-disabling-netbios-direct-hosted-smb-directsmb-if-one-dc-is-down-does-a-client-logon-to-another-dc-and-dns-forwarders-algorithm.aspx
DNS Clients and Timeouts (Part 1 & Part 2), karammasri [MSFT] Dec 2011 6:18 AM
http://blogs.technet.com/b/stdqry/archive/2011/12/02/dns-clients-and-timeouts-part-1.aspx
http://blogs.technet.com/b/stdqry/archive/2011/12/15/dns-clients-and-timeouts-part-2.aspx
Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights.