Sites and Services: /23 subnet preference inside a /8 subnet

Sorry for the less than specific title, but didn't know exact way to preface this question.
What I have is an AD domain that I need to break up into two sites; currently it's only one AD site and no subnets defined. There are about 100 different IP subnets representing geographically dispersed networks that I need to add to the subnets list.
Here's the rub: about 99 of these networks need to authenticate to an east-coast set of DCs, and only one network needs to authenticate to the west-coast set of DCs. Network subnets range from 10.1.x.x to 10.250.x.x and sizes range between /24
and /22. I can script the creation of all 100 subnets but it makes for a long list to manage and I want to know if I can do this instead:
10.0.0.0/8 East-coast site
10.160.0.0/22 West-coast site
I understand 10.160.0.0/22 falls inside of 10.0.0.0/8 but will MS treat this explicit entry /22 separately from the all-encompassing /8? If so, I am golden and will only have two subnets to manage, otherwise I will have 100.
Thanks for reading!

Yes. That is the best way to achieve that.
When an IP belongs to two defined subnets then the most specific one will be used to identify the AD site.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Similar Messages

Windows Server 2008 R2: Unable to add a subnet to Site and Services

Hi All,
I'm trying to add a new subnet to Site and Services to allow new server in that specific subnet to access the proper DC.
These are the actual subnet configured:
- 192.168.28.0/22
- 192.168.48.0/22
- 192.168.80.0/22
Now I want to add this subnet: 192.168.90.0/22
Why I cannot confirm this new subnet in the GUI?
Thanks

Hi,
Becasue the network prefix is improper.
If we use "/22" as the mask, the network prefix should be 192.168.4n.0/22 (n=0,1,2... ...).
Therefore the proper network prefix should be 192.168.88.0/22 or 192.168.92.0/22.
For detailed information about subnetting, please refer to the link below,
http://technet.microsoft.com/en-us/library/cc958834.aspx
Best Regards.
Steven Lee
TechNet Community Support

Hyper-V - Sites and Services using multiple subnets

Good evening,
Im currently setting up a test domain where I want to use multiple subnets.
My current setup is the following
- Host PC running Hyper-V manager with 1 physical NIC that connects to my router (192.168.0.1)
- Virtual Machine running Windows Server 2012 R2 - This is my domain controller aswell as DNS and DHCP server. IP address for this is 192.168.0.200
Now what im wanting to do is also create 2 more domain controllers but 'pretent' that they are in two completely different locations running off multiple subnets. Lets say one is in America and one is in Australia.
I want the addresses of these two machines the following
DC (America) - 192.168.1.1
DC (Australia) - 192.168.2.1
The reason i'll be doing this is im going to be working with Sites and Services to give me a better understanding of it.
Please can someone give me help with how I can achieve this.
Thanks.

One way to do this is to:
Setup 1 internal vSwitch. We'll use a different VLAN and subnet for each AD Site. For example, you can use VLAN 101, 102, and 103, and subnets 192.168.101.0/24, 192.168.102.0/24, and 192.168.103.0/24. This consistency will be very helpful later on.
Create a VM to act as a router, with 3 vNICs. Configure each of the 3 vNICs on a different VLAN, with a static IP on the corresponding subnet, such as 192.168.101.5, 192.168.102.5, and 192.168.103.5. Setup static routing rules if needed using Route Add
for example.
Create 3 DCs. Each DC will have a single vNIC. It can be in its own domain and forest. For example, DC101 will have a vNIC on VLAN 101, with IP 192.168.101.10/24, GW 192.168.101.5. Setup DNS on each DC.
Setup DHCP on each DC with a scope that corresponds to its subnet. For example, on DC101 setup a scope that provides IPs from 192.168.101.100 to .150, with /24 mask, .5 gateway, and .10 DNS.
As you add other VMs, if you VLAN-tag its vNIC with VLAN ID 101, it will get IP address from DC101 on the 192.168.101.0/24 subnet since DHCP ARP broadcasts will not cross the router (VM we setup earlier) by default.
Sam Boutros, Senior Consultant, Software Logic, KOP, PA http://superwidgets.wordpress.com (Please take a moment to Vote as Helpful and/or Mark as Answer, where applicable) _________________________________________________________________________________
Powershell: Learn it before it's an emergency http://technet.microsoft.com/en-us/scriptcenter/powershell.aspx http://technet.microsoft.com/en-us/scriptcenter/dd793612.aspx

Replication with Domain and Sub domain in Active directory sites and services

I seen many AD enviroments and know that when you have mutiple DCs you use Active Directory Sites and services to replicate using the NTDS Settings. If you have a Domain and sub domain do you need to do this as well or does it sync up automatically because
it's a sub domain? A see a couple of domains where the NTDS settings isn't being used to snyc with the child domain. Just wondering if that is normal or will it cause authentication errors?

I seen many AD enviroments and know that when you have mutiple DCs you use Active Directory Sites and services to replicate using the NTDS Settings. If you have a Domain and sub domain do you need to do this as well or does it sync up automatically
because it's a sub domain? A see a couple of domains where the NTDS settings isn't being used to snyc with the child domain. Just wondering if that is normal or will it cause authentication errors?
Two way transitive trusts are configured automatically when you create a child domain or tree root domain. You don't have to worry about site/subnet or replication part at least from trust perspective. But make sure site's names are unique in each domain.
How Domain and Forest Trusts Work
http://technet.microsoft.com/en-us/library/cc773178%28v=ws.10%29.aspx
http://technet.microsoft.com/en-us/library/cc730868.aspx
http://blogs.technet.com/b/askds/archive/2008/09/24/domain-locator-across-a-forest-trust.aspx
Awinish Vishwakarma - MVP
My Blog: awinish.wordpress.com
Disclaimer This posting is provided AS-IS with no warranties/guarantees and confers no rights.

Route mail and Active Directory Sites and Services configuration

Folks,
I have a problem in the internal email routing. My network is spread across various regions and the branch offices are connected together in a mpls network (full mesh). Every region has its own Exchange Server with all roles installed and the smtp connection
to the outside world is linked to two Exchange servers in the headquarter server farm.
The problem is that internally I often see emails going across the Exchange Servers in the branch offices where there is low bandwidth (from 3 to 5 Mbps), thus email are sent first to these servers instead of going immediately to the Exchange hosting
the mailboxes of the intended recipients. This happens also with inbound emails.
This causes slowness in the email system and sometimes also the network with these branch offices suffers from packet loss or very high latency.
I know that Exchange is a site-aware application and uses the Active Directory topology for message routing and to communicate with the services that are running on other Exchange 2013 computers. For this reason I have checked the Active Directory Sites
and Services and surprisingly I have found that there are no sites, no subnets, nothing has been defined but the default settings, included the Inter-Sites transport which contains the default DEFAULTIPSITELINK.
Apart from the fact that clients use logon servers which are not supposed to use in the far remote offices, I am concerned of changing the Exchange Infrastructure whilst the email system is running and I would like to ask your opinion about my next steps:
1) Create subnets for every office
2) Create sites and then link them to the subnets done in point 1
3) Delete the DEFAULTIPSITELINK and create new site links based on the costs (network speed) in order to determine the best routing server. I have 5 remote offices with 5 different network bandwidth, so I'll have to create 5 IP site links: high cost for
link with slow network, low cost for fast network.
4) (Optional) Configure the Exchange-specific cost using the Set-AdSiteLink cmdlet to the AD IP site links created previously
Apart from the valid questions on why the previous Exchange Administrator have forgotten to set up the Active Directory (Topology) Sites and Services...
...And why have chosen to install all Exchange Roles to each server when there was no reason to do that (there are two servers connected to the external smtp gateways in the headquarter, so in my opinion the Exchange Servers in the remote branch offices
should have had only the mailbox and the cas role)...
As a matter of fact, my idea is to go further and create the sites,subnets and the ip site link. If I still notice a wrong email flow, I can configure an ad-hoc Exchange-specific cost using the Set-AdSiteLink cmdlet. Does this sound reasonable to you guys
or I am taking the wrong decisions?
Thanks

Thank you very much for your link. This is exactly the page I have read just before posting my question here. It is not easy for me to understand why this has been setup this way by a Microsoft certified engineer.
There are specific rules to follow when Active Directory and Exchange are located in multiple sites and I am not a skilled Exchange Administrator... he keeps saying that it is correct and also tells that if I go forward with my ideas there is the
risk to increase the level of complexity. I prefer more complexity than default setting, and as a consequence of that, connectivity problems!
Hopefully everything goes well. I will post my results here once I have done the changes
Regards

Sites and services

guys,
i would like to create 3 dc servers with different ip´s. My domainname will be mytestingsite.com and the 3 dc's will all be residing on a differten site. 1 will be in my datacenter(in city 1), 2 others will be in city2 and city3.
How should i configure my sites and services and my dns.
many thanks.
johan

Simply proceed like the following:
Create three AD sites: City1, City2 and City3
Move Domain Controllers computer accounts to their correct sites
Create all the subnets you use and link to their correct sites
This will minimize the amount of AD replication traffic and will make your Windows clients access the closest DC when an authentication is required or when they need to get applied GPOs/scripts.
This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Get Active Directory User Last Logon
Create an Active Directory test domain similar to the production one
Management of test accounts in an Active Directory production domain - Part I
Management of test accounts in an Active Directory production domain - Part II
Management of test accounts in an Active Directory production domain - Part III
Reset Active Directory user password

Nokia sites and services

Nokia sites and services By using the build-in web browser of E63, opening this address: "http://europe.nokia.com/support/product-support/maps-support/compatibility-and-download" always ends up with blank page and this message appears: [... "fastinnerhtml!" ...] And the following address: "http://maps.ovi.com/services/mobile" ends up with this message: [... Sorry... Ovi Maps isn't available for mobile web browsers, but you can view it in all its glory on your PC or Mac. ...] Why ? Why is it that the company whose main products are smart phone but its service can not be accessed by using its phones? It seems to me, many nokia's sites are more and more complicated. I like Yahoo and Google which provide mobile sites or basic html. Perhaps, Nokia's web designers never use Nokia smart phones for browsing.
E63-1 (410.21.010)
3110c (07.21)
Padsticker
http://batu35.googlepages.com/index.html
Pimlical
http://www.pimlicosoftware.com

Hi dl
try contacts.ovi.com/dist/nmob, its what I have as a link on my E71 and you can access the maps info and stuff from there.
Alternatively, have you tried the 'my nokia' link from the mobile, you can access ovi from there and download the ovi suite and you can manage your maps using that.
Good luck.
PS I tried your 2nd link above and get the same so don't worry about it, just a matter of finding the right place
E71-1(241.04) RM-346 300.21.012

New Domain Controller does not show in our different site's Domain controller's Sites and Services

Hi,
we have two sites in our AD environment. OMA site and NY site. we have three domain controllers in our OMA site and two domain controllers in our NY site. All our DCs are windows server 2008R2 except one in our OMA site that is 2003R2 the domain
functional level is also 2003R2.
We decided to raise our functional level to 2008R2. I added a new domain controller in our OMA site and transferred all FESMOS from the DC that was running 2003R2 to this new domain controller.
the issue now is that our NY site does not make any connection with the new domain controller in OMA site. it does not even show it under sites and services. I have checked the DNS settings and everything. if you try to replicate the connections
from NY site it gives the following error: "The naming context is in the process of being removed or is not replicated from the specific server."
can anyone plz tell me why this is happening mt brain is just frozen at this moment and cant figure out why is this happening

Just noticed this replication issue has been going on for a while now but we never noticed until I added new DC. here is the error log for the NY site DC.
Log Name:      Directory Service
Source:        Microsoft-Windows-ActiveDirectory_DomainService
Date:          1/4/2014 8:11:40 AM
Event ID:      2042
Task Category: Replication
Level:         Error
Keywords:      Classic
User:          ANONYMOUS LOGON
Computer:      NORDC1.vertrue.com
Description:
It has been too long since this machine last replicated with the named source machine. The time between replications with this source has exceeded the tombstone lifetime. Replication has been stopped with this source.
The reason that replication is not allowed to continue is that the two DCs may contain lingering objects. Objects that have been deleted and garbage collected from an Active Directory Domain Services partition but still exist in the writable partitions
of other DCs in the same domain, or read-only partitions of global catalog servers in other domains in the forest are known as "lingering objects". If the local destination DC was allowed to replicate with the source DC, these potential lingering object
would be recreated in the local Active Directory Domain Services database.
Time of last successful replication:
2013-05-16 15:26:38
Invocation ID of source directory server:
9236ac56-d046-4632-b072-acbe823c5f6c
Name of source directory server:
accde843-11b2-476c-9783-9b29252d0ba5._msdcs.vertrue.com
Tombstone lifetime (days):
90
The replication operation has failed.
User Action:
The action plan to recover from this error can be found at
http://support.microsoft.com/?id=314282.
If both the source and destination DCs are Windows Server 2003 DCs, then install the support tools included on the installation CD. To see which objects would be deleted without actually performing the deletion run "repadmin /removelingeringobjects
<Source DC> <Destination DC DSA GUID> <NC> /ADVISORY_MODE". The eventlogs on the source DC will enumerate all lingering objects. To remove lingering objects from a source domain controller run "repadmin /removelingeringobjects <Source
DC> <Destination DC DSA GUID> <NC>".
If either source or destination DC is a Windows 2000 Server DC, then more information on how to remove lingering objects on the source DC can be found at
http://support.microsoft.com/?id=314282 or from your Microsoft support personnel.
If you need Active Directory Domain Services replication to function immediately at all costs and don't have time to remove lingering objects, enable replication by setting the following registry key to a non-zero value:
Registry Key:
HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Allow Replication With Divergent and Corrupt Partner
Replication errors between DCs sharing a common partition can prevent user and compter acounts, trust relationships, their passwords, security groups, security group memberships and other Active Directory Domain Services configuration data to vary between
DCs, affecting the ability to log on, find objects of interest and perform other critical operations. These inconsistencies are resolved once replication errors are resolved. DCs that fail to inbound replicate deleted objects within tombstone lifetime
number of days will remain inconsistent until lingering objects are manually removed by an administrator from each local DC. Additionally, replication may continue to be blocked after this registry key is set, depending on whether lingering objects are
located immediately.
Alternate User Action:
Force demote or reinstall the DC(s) that were disconnected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-ActiveDirectory_DomainService" Guid="{0e8478c5-3605-4e8c-8497-1e730c959516}" EventSourceName="NTDS Replication" />
    <EventID Qualifiers="49152">2042</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>5</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2014-01-04T13:11:40.963263500Z" />
    <EventRecordID>38018</EventRecordID>
    <Correlation />
    <Execution ProcessID="660" ThreadID="1596" />
    <Channel>Directory Service</Channel>
    <Computer>NORDC1.vertrue.com</Computer>
    <Security UserID="S-1-5-7" />
</System>
<EventData>
    <Data>2013-05-16 15:26:38</Data>
    <Data>9236ac56-d046-4632-b072-acbe823c5f6c</Data>
    <Data>accde843-11b2-476c-9783-9b29252d0ba5._msdcs.vertrue.com</Data>
    <Data>90</Data>
    <Data>Allow Replication With Divergent and Corrupt Partner</Data>
    <Data>System\CurrentControlSet\Services\NTDS\Parameters</Data>
</EventData>
</Event>

Configuring AD Sites and Services best practice for multiple office site ?

Hi People,
Can anyone here please suggest me or share the link of what is the best practice in configuring the AD Sites and Service for single AD domain with multiple office sites ?
I'd like to know more about the number and the direction of the connection between Domain Controllers in one site to the Data Center and vice versa.
Thanks.
/* Server Support Specialist */

Hi People,
Can anyone here please suggest me or share the link of what is the best practice in configuring the AD Sites and Service for single AD domain with multiple office sites ?
This series can be useful:
Active Directory Structure Guidelines – Part 1
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

AD Sites and Services and Best Practices

Hey All,
I am new to OES, but not new to AD. I am in an environment in which DSfW was recently setup to support VDI testing.
I notice that there is no configuration under AD Sites and Services. We have multiple sites, with DCs setup at each site. The consequence of not having Sites and Services configured is that machines/users in site "A" are logging in through site "B" domain controllers. Obviously, this is not ideal nor best practice. Secondly, this leads me to wonder how the domain controllers are replicating since I do not see NTDS entries in Sites and Service MMC for the domain controllers, yet I do see that AD data is replicating by comparing databases (simply adding a new user on one DC I see it added on the secondary DCs). So I know it's replicating, but apparantly not using AD schema?
One other question I have about DSfW is regarding the migration from a mixed environment to a full AD environment. We are deploying AD primarily due to VDI initiatives, and currently only testing this. Looking further down the road for planning purposes I have to wonder if it's possible to stand up a 2008 R2 server, join it to the domain, dc promo it, FSMO transfer, then decommossion the DSfW systems. This would leave us with purely Windows DC environment for authentication. Is this something some people have done before? Is it a recommended best path for migrating? Cause I also see others creating a second AD environment, then building the trusts between DSfW's domain and the "new" domain (assuming these are not in the same forrest). That would be less than ideal.
Thanks in advance for any responses...

Originally Posted by jmarton
DSfW does not currently support "sites and services" but it's on the
roadmap and currently targed for OES 11 SP2.
Excellent! I feel sane now :) I can live with this, as long as it's expected/normal.
It sounds like you need sites and services, but once that's in DSfW,
why migrate from DSfW to MAD if DSfW works for your VDI initiative?
You are correct. I am simply planning and making sure all the options are in play here.
I would rather not get too deeply reliant on DSfW if it will make any future possible migration more difficult. Otherwise, DSfW is extremely convenient....I am impressed actually.
I also believe there may be a way we can control the DC used for specific "contexts" (or OUs as Microsoft calls them). So if I have a group of users in a particular OU that reside at a particular branch I think I should be able to set their preferred domain controller....and if so, that means sites & services becomes nearly irrelevent. I would be ineterested to talk to people who are using DSfW with multiple sites in play.

Servers showing up multiple times in Sites and Services

I happened to catch something odd this morning while looking into another issue. When i open our domains Sites and Services and click on one of our 4 corporate DC's (3vm's one physical one of them being tested in production with server 2012 R2).
I'm seeing that a few of our servers in remote locations are showing up multiple times. However when I go to this server and click on who it's replicating with it's only showing one server and sometimes not even the same one as the corporate server.
Here is a screen shot I took.
The red's are all the same server (sorry boss has mandated we aren't allowed to put out the names for some reason). I'm a little confused as to what could be causing this. Anyone have any ideas?

Without better/more screenshots, it a bit hard to tell what you are seeing. However, in your statement
"...I'm seeing that a few of our servers in remote locations are showing up multiple
times. However when I go to this server and click on who it's replicating with it's only showing one server and sometimes not even the same one as the corporate server."
Replication is one-way connections and are always a PULL scenario. So for instance if
COR-DC-03 is replicating from COR-DC-01, the replication link will only be on COR-DC-03. COR-DC-01 may or may not replicate from 03. It may actually be replicating from another DC. Also, the AD ISTG (intersite topology generator) will always try to find the
most efficient replication and ensure that each DC has at least 2 replication partners, and there is no more than 4 hops to another DC. You have a number of sites and I assume there are DCs in there as well. All of those DCs need to replicate with one another.
Perhaps if you can draw or otherwise illustrate the issue you are seeing that would help.
Mark B. Cooper, President and Founder of PKI Solutions Inc., former Microsoft Senior Engineer and subject matter expert for Microsoft Active Directory Certificate Services (ADCS). Known as “The PKI Guy” at Microsoft for 10 years.

Missing Services from AD Sites and Services

I have not been able to find anyone with this issue.
I am missing services in AD Sites and Services.

Click on View > Show Services Node.
This
posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Microsoft
Student Partner 2010 / 2011
Microsoft
Certified Professional
Microsoft
Certified Systems Administrator: Security
Microsoft
Certified Systems Engineer: Security
Microsoft
Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
Microsoft
Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Microsoft
Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
Microsoft
Certified Technology Specialist: Windows 7, Configuring
Microsoft
Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations
Microsoft
Certified IT Professional: Enterprise Administrator
Microsoft Certified IT Professional: Server Administrator
Microsoft Certified Trainer

Setting up Subnets in Sites and Services

Having three logical sites set up, is it wrong to have the same subnet specified on the five DC's?

Scott, in Active Directory sites & subnets tool, you create sites then you create subnets with each subnet being assigned into a specific site. A unique subnet e.g. 10.10.100.0/24 can you only be in one site.
Also, once you create the sites then create subnets assigned within those sites it should replicate this information to all other domain controllers.
Does that answer your question?
Matt

DFS server / SIte and Services

Hi Guys,
A knowledge question about DFS server Windows 2008 R2.
I have four data center on each Europe location, and I will install DFS server also on the location to attach the data on the nearly site location. My domain level is Windows 2008.
Example:
Site A: 192.168.1.x
Site B: 192.178.1.x
Site C: 192.188.1.x
Site D: 192.198.1.x
I have already setup a DFS server on Site A and its working, with example IP number: 192.168.1.100, now I will setup a new DFS server for Site B, C and D. with using Full mesh replication.
When I setup a new server on site B example with IP number: 192.178.1.100 and ready to use. But if the user logon from Site B, the user have to use DFS server from site B and not from Site A site. (to get his data from server site A) If the DFS server from
site B is down the user will get his Data from Site A. She have always use Site B, how can I build this way on each location.
I heard that I have to crate a Site for this option and other information what I get is use costs options. ( and do I need a domain controller on each site)
Can somebody advice how to build and the best practice DFS server on multiple locations with one or more DFS server on location.
Kind regards,
Hakan
Good luck everyone.

Hi Hakan,
Actually it is not a DFS related question - It is AD related.
As you said you need to create sites for your different subnets and setup site link cost. Detailed steps please refer to:
Create a site
http://technet.microsoft.com/en-us/library/cc728152(v=ws.10).aspx
Configure site link cost
http://technet.microsoft.com/en-us/library/cc784142(v=ws.10).aspx
By Default DFS will provide an in-site target to clients. If no in-site target is available, it will provide an out-site target according to site link cost.
If you have any feedback on our support, please send to [email protected]

HTTPS sites and services not working on Snow Leopard 10.6.6

Hi guys, any assistance would be appreciated as I really don't want to reinstall everything again.
*Problem description:* After reinstalling Snow Leopard after some issues, I am unable to get any https services working (such as the online back up system Carbonite), nor access any https websites. My Macbook Pro and Windows Laptop on the same network have absolutely no issues with it. +Please also note that this problem is not limited to Safari, any software or browser that uses HTTPS to connect will not work.+
*Attempted fixes:* Repaired Permission errors, deleted keychain and security preferences, and manually configured the network connection. I have also checked to make sure the date/time are correct and created a new user which has also not helped.
*Recent changes:* My iMac refused to start up after permission errors so I was forced to reinstall Snow Leopard. I did a fresh install after formatting the drive.
*Operating system:* Snow Leopard 10.6.6
*System specs:* 2009 24" iMac

If I was there with you,
As a "Best Practice"
#1- I would recommend that we make a FULL Bootable Backup of where you are, and confirm that it is bootable.
Then
As another Best Practice you should always have on the ready any and all INSTALLERS of your programs, along with the corresponding serial numbers,
I feel that being PROACTIVE is a much place to be, then REACTIVE.
#2 - I would be inclined to do a overlaying install of Snow Leopard, What happens is it will install a new OS while preserving ALL other info/data, including your Applications, Users.
Please keep me posted as to your results,
Randy Mac
RMACS, LLC

Sites and Services: /23 subnet preference inside a /8 subnet

Similar Messages

Maybe you are looking for