Windows 2000 Active Directory RPC over IP Replication

This article explains how Microsoft Windows 2000 executes Active Directory replication using Remote Procedure Calls (RPC) over Internet Protocol (IP). It covers the underlying architectural components, the port negotiation process, session authentication, and the step-by-step exchange of directory updates between domain controllers.

In Microsoft Windows 2000, Active Directory relies on synchronous RPC over TCP/IP as its default protocol for intra-site replication and as a primary transport option for inter-site replication. The Directory Replication Service (DRS) Remote Procedure Call interface manages the replication process directly within the Local Security Authority Subsystem Service (lsass.exe) process on each domain controller.

1. Topology Generation and Triggering

The Knowledge Consistency Checker (KCC), a built-in process running on every domain controller, automatically computes the replication topology and generates connection objects. Replication is initiated either through change notifications (typically within a site, where a source DC notifies partners after a change occurs) or via a polling schedule (typically across sites).

In Windows 2000, replication is always "pull" driven: the destination domain controller requests changes from the source domain controller.

2. Connection Establishment and Port Resolution

When a destination domain controller needs to synchronize naming contexts, it establishes a network session using the following sequence:

  1. Endpoint Resolution: The destination domain controller contacts the RPC Endpoint Mapper service on the source domain controller over TCP port 135.
  2. Dynamic Port Assignment: The destination DC queries the Endpoint Mapper for the DRS interface UUID (e3514235-4b06-11d1-ab04-00c04fc2dcd2). The Endpoint Mapper responds with the dynamically assigned TCP port that lsass.exe registered upon startup (typically an ephemeral port between 1024 and 65535).
  3. Direct Connection: The destination DC establishes a direct TCP connection to the dynamic port returned by the Endpoint Mapper.

3. Authentication and Security

Active Directory RPC over IP enforces mutual authentication and encryption using the Security Support Provider Interface (SSPI):

  • Authentication Protocol: The domain controllers mutually authenticate using Kerberos v5. If Kerberos is unavailable, the systems attempt NTLM authentication.
  • Integrity and Privacy: Windows 2000 configures the RPC session with the RPC_C_AUTHN_LEVEL_PKT_PRIVACY authentication level. This setting signs and encrypts all RPC packets containing directory data, preventing tampering and eavesdropping over the network without requiring external protocols like IPSec.

4. The Replication Exchange (IDL_DRSGetNCChanges)

Once the secure RPC binding handle is active, the domain controllers synchronize data using specific DRS functions:

  1. Replication Request: The destination domain controller executes the IDL_DRSGetNCChanges RPC method on the source domain controller. In this call, the destination provides:
    • The naming context to replicate (Schema, Configuration, or Domain).
    • Its current High-Water Mark and Up-to-Dateness Vector, which track the highest Update Sequence Numbers (USNs) already processed by the destination.
  2. Delta Computation: The source domain controller reads the request and filters its local Active Directory database for any objects or attributes whose USN is greater than the destination's reported USN values.
  3. Data Transfer: The source DC packages the modified attributes, along with replication metadata (such as version numbers, timestamps, and originating server invocation IDs), into an RPC response packet and transmits it over the TCP socket.
  4. Application and Commit: The destination domain controller applies the changes to its local database, resolves any conflicts using the attribute version and timestamp metadata, and updates its local USN records to reflect the newly synchronized state.