Active Directory Sites and Services in Windows 2000

This article provides an overview of the Active Directory Sites and Services snap-in in Microsoft Windows 2000, detailing how it defines physical network topology, optimizes directory replication, and streamlines client logon traffic. Active Directory Sites and Services provides administrators with the centralized interface required to map logical directory components to the underlying physical network architecture.

Mapping Physical Network Topology

While the Active Directory Users and Computers console handles the logical structure of an organization—such as domains, trees, and organizational units (OUs)—Active Directory Sites and Services focuses entirely on the physical network. In Windows 2000, a site is defined as one or more well-connected TCP/IP subnets. Using this tool, administrators define:

  • Subnets: Specific IP network ranges defined by network addresses and subnet masks.
  • Sites: Geographic or localized groupings of subnets connected by high-speed, reliable bandwidth (such as a local area network).
  • Server Placement: Moving domain controller computer objects into their respective physical sites to ensure the directory reflects their real-world location.

Controlling Directory Replication

One of the primary functions of Active Directory Sites and Services is regulating how and when directory data replicates between domain controllers.

  • Intrasite Replication: Within a single site, replication is assumed to be fast and inexpensive. The Knowledge Consistency Checker (KCC) automatically creates ring topologies using Remote Procedure Calls (RPC) over IP, and data replicates automatically without compression to reduce CPU overhead.
  • Intersite Replication: Between different sites, bandwidth is often limited or expensive (such as across WAN links). Administrators use the tool to configure Site Links, specifying the replication schedule, cost, and frequency. Data sent between sites is heavily compressed to conserve bandwidth.
  • Transport Protocols: Administrators can configure replication using either IP (synchronous RPC) or SMTP (asynchronous mail-based transport for intermittently connected or unreliable links).

Optimizing Client Authentication and Service Discovery

The tool directly influences how Windows 2000 workstations locate domain controllers. When a client boots and queries DNS, the Netlogon service uses the client’s IP address to evaluate which subnet and site it belongs to.

Active Directory Sites and Services ensures that authentication, Kerberos ticket requests, and directory queries are directed to a local domain controller within the same site. This prevents authentication delays, eliminates redundant WAN traffic, and ensures fallback to remote domain controllers only if all local servers fail.

For complex enterprise networks, Active Directory Sites and Services allows administrators to designate bridgehead servers. A bridgehead server acts as the primary contact point for intersite replication, receiving updates from external sites and distributing them internally to other local domain controllers.

Additionally, administrators can create Site Link Bridges to define transitive routing paths between multiple site links when full IP connectivity exists, or disable automatic bridging to strictly enforce routed traffic paths.