Windows 2000 Site-Aware Remote Logon Process

In Microsoft Windows 2000, site-aware logons ensure that remote branch office clients authenticate against the closest domain controller (DC) rather than consuming valuable wide area network (WAN) bandwidth. By mapping client IP subnets to Active Directory sites, the Windows 2000 Netlogon service dynamically identifies the client's physical location, caches site membership, and directs authentication requests to the most optimal DC available.

Initial Discovery and DNS Query

When a Windows 2000 client starts or initiates a user logon, the local Netlogon service uses the DC Locator mechanism (DsGetDcName) to find a domain controller.

  1. Registry Check: The client first checks its local registry (HKLM\System\CurrentControlSet\Services\Netlogon\Parameters\SiteName) to determine if a site name is already cached from a previous session.
  2. DNS SRV Resolution:
    • If a site name is cached: The client queries DNS for site-specific SRV records matching _ldap._tcp.<SiteName>._sites.dc._msdcs.<DomainName>.
    • If no site name is cached: The client queries DNS for generic domain controller records matching _ldap._tcp.dc._msdcs.<DomainName>, returning a list of any reachable DCs across the enterprise.

Subnet Identification and LDAP Ping

Once the client receives an IP address for a candidate DC, it sends an LDAP ping (a connectionless UDP message) to determine availability and site proximity.

  1. Client IP Evaluation: The receiving DC checks the incoming client's IP address against the subnet definitions configured in Active Directory Sites and Services.
  2. Site Assignment Response: The DC responds with a message that includes:
    • The Active Directory site to which the client belongs based on its subnet.
    • The site where the DC itself resides.
    • A bit-flag indicating whether the responding DC is within the client’s designated site.

Cache Update and Re-Query

If the answering DC confirms it is in the client's site, the authentication process continues immediately.

If the responding DC is in a different site (such as a central hub DC answering an unconfigured or newly booted branch client), the process redirects:

  1. The client writes the returned site name into its local registry cache.
  2. The client halts interaction with the non-local DC.
  3. The client issues a new DNS query targeting its newly discovered site: _ldap._tcp.<SiteName>._sites.dc._msdcs.<DomainName>.
  4. The client selects a DC returned from this site-specific query, sends a new LDAP ping, and proceeds to authenticate.

Branch Offices Without Local Domain Controllers

In branch office topologies where no local DC exists, Active Directory uses site link costs to select an optimal remote DC.

When the client discovers that its assigned site contains no active DC records in DNS:

  1. The client falls back to querying generic domain-wide SRV records.
  2. The client contacts an available remote DC across the WAN link.
  3. Windows 2000 attempts to select the DC associated with the lowest site link cost relative to the client’s defined site, ensuring that WAN traffic routes across the most cost-effective path available.

Authentication Completion

After binding to the chosen domain controller via Remote Procedure Call (RPC) and SMB, the client negotiates authentication using Kerberos v5 (or NTLM if Kerberos is unavailable). Subsequent requests—such as Group Policy downloads and roaming profile retrievals—are pinned to this site-aware domain controller for the duration of the logon session.