Windows 2000 KCC Site Replication Topology

This article provides an overview of how the Knowledge Consistency Checker (KCC) automatically designs and manages Active Directory replication topologies in Microsoft Windows 2000 Server. It details the mechanisms behind both intrasite and intersite topology generation, the election and role of the Inter-Site Topology Generator (ISTG), the function of bridgehead servers, and how the underlying algorithm maintains an efficient, loop-free replication path across the enterprise network.

The Knowledge Consistency Checker is a built-in process that runs as part of the Directory System Agent (DSA) on every Windows 2000 domain controller. By default, it executes every 15 minutes to evaluate the state of the directory and compute an optimized replication path, creating or deleting nTDSConnection objects as needed to reflect network changes, server additions, or hardware failures.

Intrasite Topology Generation

Within a single Active Directory site, the KCC creates a bidirectional ring topology. This design ensures that every domain controller has at least two inbound replication connections, providing built-in fault tolerance if a single server goes offline.

To optimize performance and minimize replication latency, the KCC enforces the "three-hop rule." If a ring topology expands to a size where data would take more than three hops to travel between any two domain controllers, the KCC automatically introduces shortcut connection objects across the ring. Because communication within a site assumes high-bandwidth, reliable network connectivity, intrasite replication data is transmitted uncompressed using Remote Procedure Calls (RPC) over IP.

Intersite Topology and the Inter-Site Topology Generator (ISTG)

Replication between distinct sites operates differently to conserve Wide Area Network (WAN) bandwidth. Rather than every domain controller managing WAN connections, the KCC designates a single domain controller in each site to manage intersite topology. This server is the Inter-Site Topology Generator (ISTG).

In Windows 2000, the ISTG is elected based on server GUIDs. The domain controller with the lowest server object GUID in the site configuration container assumes the ISTG role. The ISTG is exclusively responsible for evaluating the intersite network layout and generating inbound connection objects for that site from external bridgehead servers.

Bridgehead Servers and Transports

Intersite replication relies on bridgehead servers to act as the primary contact points between sites:

  • Bridgehead Selection: Administrators can manually designate preferred bridgehead servers. If none are specified, the KCC automatically selects bridgehead servers based on the available network protocols.
  • Transports: Windows 2000 supports two intersite transport mechanisms: IP (RPC over IP) and SMTP. IP is typically used for fully routed, reliable networks, while SMTP is reserved for asynchronous, low-bandwidth, or unreliable connections between domain boundaries.
  • Data Compression: Unlike intrasite replication, data transmitted between bridgehead servers across site links is heavily compressed to reduce WAN utilization.

The Topology Algorithm Execution

During each execution cycle, the KCC performs the following structured operations:

  1. Information Retrieval: The KCC reads the configuration naming context to identify all sites, subnets, site links, site link bridges, and active domain controllers.
  2. Spanning Tree Evaluation: Using Dijkstra's algorithm, the KCC determines the least-cost path across defined site links to build a spanning tree that interconnects all sites without loops.
  3. Connection Object Management:
    • For intrasite replication, each local KCC ensures the local ring and shortcut connections are intact.
    • For intersite replication, the ISTG determines which bridgehead servers need to communicate and creates inbound nTDSConnection objects on the target bridgehead servers.
  4. Stale Connection Cleanup: The KCC verifies the validity of existing connection objects. If a domain controller has been permanently decommissioned or a site link cost has changed, the KCC removes obsolete connections to prevent replication errors and optimize resource use.