Active Directory SMTP Replication in Windows 2000

In Microsoft Windows 2000, Active Directory utilizes the Simple Mail Transport Protocol (SMTP) as an alternative transport mechanism for intersite replication across unreliable or asynchronous network connections. This article explains how Windows 2000 manages SMTP-based replication, detailing the role of the Intersite Messaging (ISM) service, the security requirements involving Public Key Infrastructure (PKI), the strict architectural limitations on which directory partitions can be replicated, and the end-to-end message delivery process between domain controllers.

Role of the Intersite Messaging Service

Windows 2000 delegates non-RPC transport replication to the Intersite Messaging (ISM) service (ismserv.exe). While intra-site replication and standard intersite replication rely directly on synchronous Remote Procedure Calls (RPC) over IP, asynchronous SMTP replication abstracts transport from the core directory service.

When replication is triggered between sites configured to use SMTP, the Directory System Agent (DSA) hands the directory updates to the ISM service. The ISM service utilizes Collaboration Data Objects (CDO) to format the replication requests into standard MIME-compliant email messages, handling the packaging and queuing necessary for transit over mail systems.

Partition Limitations and Restrictions

SMTP replication in Windows 2000 is intentionally restricted and cannot be used for all directory partitions. It supports the replication of:

  • The Configuration partition.
  • The Schema partition.
  • The Global Catalog (partial, read-only domain directory partitions).

Windows 2000 strictly prohibits replicating writable domain partitions over SMTP. Because SMTP is an asynchronous, store-and-forward mechanism, it cannot guarantee the immediate consistency required for transactions in a writable domain partition, such as password changes or security identifier (SID) generation. Consequently, domain controllers in different sites that belong to the exact same domain cannot replicate their domain naming context over SMTP; they must use RPC over IP.

Security and PKI Integration

Because SMTP traffic often traverses untrusted networks or the public internet, Windows 2000 mandates robust cryptographic protection. SMTP replication requires an operational Enterprise Certificate Authority (CA) integrated with Active Directory.

Before replication can occur, all domain controllers participating in SMTP transport must obtain an X.509 machine certificate. The ISM service uses these certificates to sign and encrypt replication messages using Secure/Multipurpose Internet Mail Extensions (S/MIME). Signing prevents tampering and spoofing, while encryption ensures confidentiality of sensitive directory attributes during transit.

Administrators configure SMTP transport within the Active Directory Sites and Services console. Instead of adding site links to the standard IP transport container, links are created under the SMTP transport container.

Each SMTP site link defines:

  • Cost: A numerical value reflecting the relative bandwidth and latency of the connection.
  • Replication Schedule: Defined intervals specifying when replication traffic is allowed to travel.
  • Replication Frequency: How often the directory checks for changes during the scheduled window.

The Knowledge Consistency Checker (KCC) reads this configuration to automatically generate an optimal replication topology spanning the defined sites.

End-to-End Replication Process

The lifecycle of an SMTP replication event follows a clear sequence:

  1. Change Notification: A change occurs in the Configuration, Schema, or Global Catalog partition on a bridgehead server.
  2. Message Assembly: The local directory service notifies the ISM service, which packages the replication data into an email using CDO.
  3. Encryption: The message is digitally signed and encrypted via S/MIME using the recipient domain controller's public key.
  4. Transmission: The message is submitted to the local Internet Information Services (IIS) default SMTP virtual server and routed across the network to the destination bridgehead server.
  5. Receipt and Extraction: The destination server's IIS SMTP service receives the message and routes it to the local drop directory.
  6. Processing: The receiving ISM service picks up the email, decrypts the payload, validates the cryptographic signature, and passes the raw directory updates to the destination's Active Directory database (ntds.dit) to complete replication.