Active Directory / Intermediate / Lesson 10

Sites, subnets, and replication topology

Model locality from declared network prefixes and distinguish logical site links from the physical network, controller scope, and replication health.

About 5 min readContent reviewed 2026-10-26

On this page

Lesson goals

Explain site membership independently of domain and OU placement.
Map documentation addresses with a safe offline model.
Review link costs, schedules, routing assumptions, and KCC ownership.

A site describes connectivity, not a department

Sites model network locality for directory services and replication. Subnet objects associate address ranges with sites, helping clients and applications choose appropriate nearby services. A site can contain controllers for several domains, and a domain can span several sites. Moving a user to another OU does not move the user’s current device network into a new site. Record actual network prefixes, reliable connectivity, controller placement, and application requirements. A building name alone is insufficient when VPNs, branch connections, IPv6, or network changes affect the client’s actual address and path. Keep logical account organization separate from this physical-topology design.

Parse documentation addresses without contacting them

The complete Python fixture uses only ipaddress arithmetic on documentation prefixes. It returns the single matching site or unmapped when no declared prefix contains the address. It rejects ambiguous input in the model rather than claiming to implement every real directory matching rule. The two /25 ranges split one documentation /24 into nonoverlapping halves. No address is pinged, scanned, resolved, or queried. A real site mapping must also match the authorized directory configuration and client observation. This model is useful for reviewing a proposed prefix inventory, not certifying the live site selected by DC Locator.

python Offline documentation-subnet assignment model

from ipaddress import ip_address, ip_network
subnets = [(ip_network("192.0.2.0/25"), "East"), (ip_network("192.0.2.128/25"), "West")]
def modeled_site(text):
    matches = [site for network, site in subnets if ip_address(text) in network]
    if len(matches) > 1:
        raise ValueError("ambiguous model")
    return matches[0] if matches else "unmapped"
for address in ["192.0.2.10", "192.0.2.200", "198.51.100.10"]:
    print(modeled_site(address))

Expected output

East
West
unmapped

The outputs are East, West, and unmapped. This is local address arithmetic, not a network or domain discovery operation.

A site link is not a packet route

Site links describe permitted replication relationships, relative costs, and schedules used by the topology design. A lower configured cost is a design preference, not a measured latency or a firewall rule. The network must actually support the required communication, and transitive site-link assumptions must reflect routing reality. KCC-generated connections normally adapt to the directory topology; manually adding many connections can make maintenance harder and should not replace diagnosis. Intrasite and intersite behaviors differ, and each naming context has relevant replicas. A visually connected site diagram does not prove a particular partition has a healthy inbound replication path.

Declare the network assumptions behind a schedule

The contextual record names two sites and a conceptual approved replication window. It is not an AD site-link object or an import format. A real plan needs bandwidth, reliability, latency objectives, failure paths, supported transport/security requirements, and change ownership. Do not copy one universal schedule into every branch or assume that a link cost can compensate for an unavailable route. Include remote access and new subnet allocations in the review. A branch without an appropriate controller may legitimately use another site according to supported discovery behavior, but that fallback must be considered when evaluating logon and policy latency.

json Non-runnable topology review record

{"sites":["East","West"],"prefix_inventory":"documentation_only","site_link":{"members":["East","West"],"relative_cost":100,"schedule":"approved-window-model"},"network_routing":"must_be_verified_separately"}

The record states logical intent and a separate routing dependency. It changes no subnet, site link, firewall, or replication connection.

Verify locality and convergence as separate outcomes

Compare the client’s actual site evidence, selected controller, required service capability, and request outcome using approved records. Then review replication history for the relevant partitions and links. A nearby controller can be stale, while a remote controller can be healthy but slower than the objective. Test topology changes in an authorized isolated plan before production approval and preserve previous configuration for rollback. No Windows tool or replication operation is run here. The goal is a bounded explanation of why a client or replica chose a path, not a blanket instruction to alter sites whenever one sign-in is slow.

Common errors and fixes

OU placement is used to predict a device’s site.

Why it happens: Administrative containment was confused with network locality.
How to fix it: Review address-prefix and site evidence separately.
Prevent it next time: Keep logical and physical diagrams distinct.

A site-link cost is treated as measured latency.

Why it happens: A configured preference was mistaken for network evidence.
How to fix it: Measure authorized network objectives independently.
Prevent it next time: Document the meaning and owner of each cost.

New VPN addresses select an unexpected service location.

Why it happens: The prefix inventory and locality assumptions were not updated.
How to fix it: Review actual client address/site evidence and the approved mapping.
Prevent it next time: Include address changes in directory change management.

Check your understanding

1. Classify 192.0.2.127 and 192.0.2.128 in the model. Explain why this is useful but not sufficient operational evidence.

Show worked solution

The first belongs to East and the second to West, verifying the declared /25 boundary. This catches inventory mistakes in local arithmetic but does not establish the client’s real address, actual AD subnet objects, locator cache, or network path. Preserve this boundary test and obtain authorized environment evidence for live behavior.

2. East and West are connected in a site-link diagram but a firewall blocks required communication. Can changing relative cost alone repair replication?