Active Directory 複寫概念Active Directory Replication Concepts

適用於:Windows Server 2016、Windows Server 2012 R2、Windows Server 2012Applies To: Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

設計拓撲網站時前, 熟悉一些 Active Directory 複寫概念。Before designing site topology, become familiar with some Active Directory replication concepts.

連接物件Connection object

連接物件是表示目的地網域控制站的來源網域控制站的複寫連接 Active Directory 物件。A connection object is an Active Directory object that represents a replication connection from a source domain controller to a destination domain controller. 網域控制站單一網站的成員,並都會在網站中 Active Directory Domain Services (AD DS) 伺服器物件。A domain controller is a member of a single site and is represented in the site by a server object in Active Directory Domain Services (AD DS). 每個伺服器物件有 NTDS 設定物件代表複製網域控制站在網站中的某位子女。Each server object has a child NTDS Settings object that represents the replicating domain controller in the site.

連接是 NTDS 設定物件目的伺服器上的子女。The connection object is a child of the NTDS Settings object on the destination server. 複製之間兩個網域控制站伺服器物件的其中一個必須連接物件代表輸入的複寫從其他。For replication to occur between two domain controllers, the server object of one must have a connection object that represents inbound replication from the other. 所有複寫連接網域控制站都儲存為 NTDS 設定物件下連接物件。All replication connections for a domain controller are stored as connection objects under the NTDS Settings object. 連接物件辨識複寫來源伺服器、包含複寫排程及指定複寫傳輸。The connection object identifies the replication source server, contains a replication schedule, and specifies a replication transport.

知識一致性檢查程式 (KCC) 會自動建立連接物件,但它們也可以建立以手動方式。The Knowledge Consistency Checker (KCC) creates connection objects automatically, but they can also be created manually. 建立者 KCC 連接物件會出現在 Active Directory 網站和服務] 嵌入式管理單元為並視為適當在正常運作的條件。Connection objects created by the KCC appear in the Active Directory Sites and Services snap-in as and are considered adequate under normal operating conditions. 系統管理員所建立的連接物件手動建立連接物件。Connection objects created by an administrator are manually created connection objects. 建立時,系統管理員指派的名稱,可連接手動建立的物件。A manually created connection object is identified by the name assigned by the administrator when it was created. 當您修改連接物件,您將它轉換成系統管理員修改的連接物件與物件 GUID 的形式顯示。When you modify an connection object, you convert it into an administratively modified connection object and the object appears in the form of a GUID. KCC 不會以手動或修改連接物件進行變更。The KCC does not make changes to manual or modified connection objects.

KCCKCC

KCC 是所有網域控制站上執行,並產生複寫 Active Directory 樹系拓撲建程序。The KCC is a built-in process that runs on all domain controllers and generates replication topology for the Active Directory forest. KCC 建立不同複寫拓撲根據是否複寫(站台間)網站或之間網站(間)。The KCC creates separate replication topologies depending on whether replication is occurring within a site (intrasite) or between sites (intersite). KCC 也動態調整拓撲容納新增新的網域控制站在移除現有的網域控制站、移動的網域控制站的網站、變更成本及排程暫時無法使用的網域控制站或發生錯誤。The KCC also dynamically adjusts the topology to accommodate the addition of new domain controllers, the removal of existing domain controllers, the movement of domain controllers to and from sites, changing costs and schedules, and domain controllers that are temporarily unavailable or in an error state.

網站,請在間寫入網域控制站是隨時以雙向更新步調,以減少延遲大的網站以其他快顯連接。Within a site, the connections between writable domain controllers are always arranged in a bidirectional ring, with additional shortcut connections to reduce latency in large sites. 手動,間拓撲是層次的跨樹,這表示一間連接才會出現任何兩個網站的每個 directory 磁碟分割時,且通常不包含快顯連接。On the other hand, the intersite topology is a layering of spanning trees, which means one intersite connection exists between any two sites for each directory partition and generally does not contain shortcut connections. 跨樹與 Active Directory 複寫拓撲的相關詳細資訊,會看到 Active Directory 複寫拓撲技術參考 (http://go.microsoft.com/fwlink/?LinkID=93578)。For more information about spanning trees and Active Directory replication topology, see Active Directory Replication Topology Technical Reference (http://go.microsoft.com/fwlink/?LinkID=93578).

每個網域控制站,KCC 建立複寫路徑建立單向輸入的連接物件定義從其他網域控制站連接。On each domain controller, the KCC creates replication routes by creating one-way inbound connection objects that define connections from other domain controllers. 網域控制站在相同的網站,KCC 建立連接物件自動介入管理。For domain controllers in the same site, the KCC creates connection objects automatically without administrative intervention. 當您有多個網站時,您設定的網站連結之間的網站,並在每個網站單一 KCC 自動建立之間網站連接也。When you have more than one site, you configure site links between sites, and a single KCC in each site automatically creates connections between sites as well.

Windows Server 2008 Rodc KCC 改進KCC improvements for Windows Server 2008 RODCs

有許多 KCC 改進,以配合 Windows Server 2008 的新提供唯讀網域控制站 (RODC)。There are a number of KCC improvements to accommodate the newly available read-only domain controller (RODC) in Windows Server 2008 . RODC 一般部署案例是分公司。A typical deployment scenario for RODC is the branch office. 本案例中最常部署的複寫 Active Directory 拓撲根據少數 bridgehead 伺服器中樞網站的分支」的網域控制站在多個網站複製中樞支點設計。The Active Directory replication topology most commonly deployed in this scenario is based on a hub-and-spoke design, where branch domain controllers in multiple sites replicate with a small number of bridgehead servers in a hub site.

其中一個優點部署 RODC 在本案例中為單向複寫。One of the benefits of deploying RODC in this scenario is unidirectional replication. 伺服器 bridgehead 就不需要從 RODC,可減少管理和網路使用複製的。Bridgehead servers are not required to replicate from the RODC, which reduces administration and network usage.

不過,系統挑戰,在舊版 Windows Server 作業系統的中心輻拓撲反白顯示是中樞中新增新的 bridgehead 網域控制站之後, 還有轉散發複寫連接中樞網域控制站利用新中樞網域控制站的分支」的網域控制站之間不自動機制。However, one administrative challenge highlighted by the hub-spoke topology on previous versions of the Windows Server operating system is that after adding a new bridgehead domain controller in the hub, there is no automatic mechanism to redistribute the replication connections between the branch domain controllers and the hub domain controllers to take advantage of the new hub domain controller.

Windows Server 2003 網域控制站,您可以重新工作負載平衡所使用的工具,例如 Adlb.exe 從 Windows Server 2003 分支 Office 部署指南 (http://go.microsoft.com/fwlink/?LinkID=28523)。For Windows Server 2003 domain controllers, you can rebalance the workload by using a tool such as Adlb.exe from the Windows Server 2003 Branch Office Deployment Guide (http://go.microsoft.com/fwlink/?LinkID=28523).

Windows Server 2008 rodc,正常運作的 KCC 提供一些平衡,讓您不需要使用其他工具,例如 Adlb.exe。For Windows Server 2008 RODCs, normal functioning of the KCC provides some rebalancing, which eliminates the need to use an additional tool such as Adlb.exe. 預設會讓的新功能。The new functionality is enabled by default. 您可以停用來新增下列設定 RODC 機碼:You can disable it by adding the following registry key set on the RODC:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\ParametersHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters

[隨機 BH Loadbalancing 允許」"Random BH Loadbalancing Allowed"
1 = 啟用(預設值)0 = 停用1 = Enabled (default), 0 = Disabled

這些 KCC 改進的運作方式的相關詳細資訊,會看到規劃和部署 Active Directory Domain Services 進行分公司 (http://go.microsoft.com/fwlink/?LinkId=107114)。For more information about how these KCC improvements work, see Planning and Deploying Active Directory Domain Services for Branch Offices (http://go.microsoft.com/fwlink/?LinkId=107114).

錯誤後移轉功能Failover functionality

請確定複寫失敗網路與離線網域控制站路由傳送網站。Sites ensure that replication is routed around network failures and offline domain controllers. 調整 AD DS 中進行的變更︰ 複寫拓撲指定的時間間隔可以執行 KCC,例如時新增新的網域控制站的新網站建立與。The KCC runs at specified intervals to adjust the replication topology for changes that occur in AD DS, such as when new domain controllers are added and new sites are created. KCC 評論複寫狀態的現有的連接,以判斷任何連接會無法運作。The KCC reviews the replication status of existing connections to determine if any connections are not working. 如果因為失敗的網域控制站連接無法運作,KCC 自動組建暫時連接到其他協力(如果有的話)確保複寫進行。If a connection is not working due to a failed domain controller, the KCC automatically builds temporary connections to other replication partners (if available) to ensure that replication occurs. 如果所有網域控制站在網站中的無法使用,KCC 會自動建立網域控制站另一網站之間複寫連接。If all the domain controllers in a site are unavailable, the KCC automatically creates replication connections between domain controllers from another site.

子網路Subnet

子網路是一組邏輯 IP 位址指派給 TCP/IP 網路的區段。A subnet is a segment of a TCP/IP network to which a set of logical IP addresses are assigned. 子網路群組的電腦將在網路上的實體近接辨識的方式。Subnets group computers in a way that identifies their physical proximity on the network. 子網路物件 AD DS 中的找出所使用的網站以地圖電腦的網路位址。Subnet objects in AD DS identify the network addresses that are used to map computers to sites.

網站Site

網站的 Active Directory 物件代表連接高度可靠且更快速的網路的一或多個 TCP/IP 子網路。Sites are Active Directory objects that represent one or more TCP/IP subnets with highly reliable and fast network connections. 網站資訊可讓系統管理員設定 Active Directory 存取和複寫最佳化實體網路的使用量。Site information allows administrators to configure Active Directory access and replication to optimize usage of the physical network. 物件網站的相關聯的一組子網路,而且森林中的每個網域控制站相關聯的 Active Directory 網站根據其 IP 位址。Site objects are associated with a set of subnets, and each domain controller in a forest is associated with an Active Directory site according to its IP address. 網站可以裝載網域控制站的多個網域,並網域可以會以多個網站。Sites can host domain controllers from more than one domain, and a domain can be represented in more than one site.

網站連結Site link

Active Directory 物件代表邏輯路徑 KCC 用來建立複寫 Active Directory 連接的網站連結。Site links are Active Directory objects that represent logical paths that the KCC uses to establish a connection for Active Directory replication. 網站連結物件代表一組可以透過指定間傳輸統一成本通訊的網站。A site link object represents a set of sites that can communicate at uniform cost through a specified intersite transport.

被視為網站連結中所包含的所有網站使用相同的網路類型連接。All sites contained within the site link are considered to be connected by means of the same network type. 網站必須手動連結至其他網站使用的網站連結,以便在某個網站的網域控制站可以從在另一部網站網域控制站複寫 directory 變更。Sites must be manually linked to other sites by using site links so that domain controllers in one site can replicate directory changes from domain controllers in another site. 因為不符網站連結複製期間拍攝網路封包實體網路上的實際路徑,您不需要建立備援網站連結,以改善 Active Directory 複寫效率。Because site links do not correspond to the actual path taken by network packets on the physical network during replication, you do not need to create redundant site links to improve Active Directory replication efficiency.

連接兩個網站的網站連結,複寫系統會自動建立特定的網域控制站在每個網站稱為 bridgehead 伺服器之間連接。When two sites are connected by a site link, the replication system automatically creates connections between specific domain controllers in each site that are called bridgehead servers. Windows Server 2008、網站的所有主機相同的 directory 磁碟分割的網域控制站將為已選取為 bridgehead 伺服器的候選項目。In Windows Server 2008 , all domain controllers in a site that host the same directory partition are candidates for being selected as bridgehead servers. 建立者 KCC 複寫連接隨機閃爍的問題分散在所有的候選項目 bridgehead 伺服器中分享複寫工作負載的網站。The replication connections created by the KCC are randomly distributed among all candidate bridgehead servers in a site to share the replication workload. 根據預設,隨機的選擇程序發生一次,當連接物件第一次新增至該網站。By default, the randomized selection process takes place only once, when connection objects are first added to the site.

網站連結橋接器為 Active Directory 物件代表一組的網站連結,其網站的所有可以通訊使用一般的傳輸。A site link bridge is an Active Directory object that represents a set of site links, all of whose sites can communicate by using a common transport. 網站連結橋接器讓網域控制站不會直接連接透過通訊彼此的連結。Site link bridges enable domain controllers that are not directly connected by means of a communication link to replicate with each other. 通常網站連結橋接器對應至路由器(或一組路由器)IP 網路。Typically, a site link bridge corresponds to a router (or a set of routers) on an IP network.

根據預設,KCC 可以形成轉移透過有共同的某些網站的所有網站連結。By default, the KCC can form a transitive route through any and all site links that have some sites in common. 如果已停用這種情形時,每個網站連結表示它自己的不同,且隔離網路。If this behavior is disabled, each site link represents its own distinct and isolated network. 透過網站連結橋接器表示的網站連結,會被視為單一之前的路徑。Sets of site links that can be treated as a single route are expressed through a site link bridge. 每個橋接器表示隔離的通訊網路流量的環境。Each bridge represents an isolated communication environment for network traffic.

網站連結橋接器的邏輯代表轉移網站之間的實體連接的機制。Site link bridges are a mechanism to logically represent transitive physical connectivity between sites. 網站連結橋接器可 KCC 使用包含的網站的任何的連結組合來判斷連接 directory 磁碟分割中這些網站保存最便宜路徑。A site link bridge allows the KCC to use any combination of the included site links to determine the least expensive route to interconnect directory partitions held in those sites. 網站連結橋接器不提供的網域控制站的實際連接。The site link bridge does not provide actual connectivity to the domain controllers. 移除網站連結橋接器時,如果複寫組合的網站連結到將會繼續 KCC 移除的連結。If the site link bridge is removed, replication over the combined site links will continue until the KCC removes the links.

網站連結橋接器時才會網站包含網域控制站裝載的 directory 磁碟分割,也不裝載網域控制站在相鄰網站上,但裝載 directory 磁碟分割網域控制站位於一或多個其他網站森林中。Site link bridges are only necessary if a site contains a domain controller hosting a directory partition that is not also hosted on a domain controller in an adjacent site, but a domain controller hosting that directory partition is located in one or more other sites in the forest. 定義相鄰網站以包含在單一網站連結任何兩個或更多的網站。Adjacent sites are defined as any two or more sites included in a single site link.

網站連結橋接器邏輯之間建立連接兩個網站連結,為兩個中斷連接網站使用暫時之網站間的轉移路徑。A site link bridge creates a logical connection between two site links, providing a transitive path between two disconnected sites by using an interim site. 為了間拓撲發電機 (ISTG),橋接器表示使用暫時網站的實體連接。For the purposes of the intersite topology generator (ISTG), the bridge implies physical connectivity by using the interim site. 橋接器並不代表暫時網站的網域控制站將會提供複寫路徑。The bridge does not imply that a domain controller in the interim site will provide the replication path. 不過,這會是因為暫時網站包含網域控制站裝載複寫 directory 磁碟分割,此時網站連結橋接器不需要。However, this would be the case if the interim site contained a domain controller that hosted the directory partition to be replicated, in which case a site link bridge is not required.

新增的每個網站連結的費用,建立的結果路徑總和應的成本。The cost of each site link is added, creating a summed cost for the resulting path. 如果暫時網站並未包含網域控制站主控 directory 磁碟分割,並不存在成本較低的連結,就會使用橋接器網站連結。The site link bridge would be used if the interim site does not contain a domain controller hosting the directory partition and a lower cost link does not exist. 暫時網站包含網域控制站裝載 directory 磁碟分割,如果有兩個中斷連接的網站會複寫連接到暫時的網域控制站設定,然後使用橋接器。If the interim site contained a domain controller that hosts the directory partition, two disconnected sites would set up replication connections to the interim domain controller and not use the bridge.

預設所有網站的連結轉移,或「橋接」。By default all site links are transitive, or "bridged." 當橋網站的連結,排程重疊 KCC 建立複寫連接,以判斷網域控制站複寫合作夥伴之間網站的網站不會直接連接網站的連結,但間接連接透過一組常用網站的位置。When site links are bridged and the schedules overlap, the KCC creates replication connections that determine domain controller replication partners between sites, where the sites are not directly connected by site links but are connected transitively through a set of common sites. 這表示,您可以連接任何網站的網站連結組合透過任何其他網站。This means that you can connect any site to any other site through a combination of site links.

一般而言,完全路由網路,您不需要建立任何網站連結橋接器,除非您想要的變更︰ 複寫掌控。In general, for a fully routed network, you do not need to create any site link bridges unless you want to control the flow of replication changes. 如果完全不路由傳送您的網路,以避免嘗試:鬼影行動複寫應該建立網站連結橋接器。If your network is not fully routed, site link bridges should be created to avoid impossible replication attempts. 該傳輸的單一網站連結橋接隱含屬於特定傳輸所有網站連結。All site links for a specific transport implicitly belong to a single site link bridge for that transport. 網站連結預設橋接會自動,不 Active Directory 物件代表該橋接器。The default bridging for site links occurs automatically, and no Active Directory object represents that bridge. 所有網站的連結,ios 都橋接器設定,請在 IP 和簡易郵件傳輸通訊協定 (SMTP) 間傳輸容器的屬性中找到實作橋接自動網站連結。The Bridge all site links setting, found in the properties of both the IP and Simple Mail Transfer Protocol (SMTP) intersite transport containers, implements automatic site link bridging.

注意

AD ds; 未來版本中將不支援 SMTP 複寫因此,不建議的網站連結物件建立 SMTP 容器中。SMTP replication will not be supported in future versions of AD DS; therefore, creating site links objects in the SMTP container is not recommended.

通用伺服器Global catalog server

通用伺服器是儲存在樹系資訊所有物件的網域控制站,讓應用程式可以搜尋 AD DS,而不需要參考特定網域控制站的市集要求的資料。A global catalog server is a domain controller that stores information about all objects in the forest, so that applications can search AD DS without referring to specific domain controllers that store the requested data. 所有網域控制站,例如通用伺服器會儲存完整的寫入架構與設定 directory 磁碟分割複本完整、寫入網域它裝載的網域 directory 磁碟分割複本。Like all domain controllers, a global catalog server stores full, writable replicas of the schema and configuration directory partitions and a full, writable replica of the domain directory partition for the domain that it is hosting. 此外,通用伺服器會儲存森林中的每個其他的網域部分、唯讀複本。In addition, a global catalog server stores a partial, read-only replica of every other domain in the forest. 部分、唯讀網域複本包含每個網域,但僅限子集屬性(最常使用的搜尋物件的屬性)中的物件。Partial, read-only domain replicas contain every object in the domain but only a subset of the attributes (those attributes that are most commonly used for searching the object).

快取通用群組成員資格Universal group membership caching

快取通用群組成員資格可網域控制站使用者快取通用群組成員資格資訊。Universal group membership caching allows the domain controller to cache universal group membership information for users. 您可以讓網域控制站的 Windows Server 2008 快取通用群組成員資格使用來執行 Active Directory 網站與服務] 嵌入式管理單元。You can enable domain controllers that are running Windows Server 2008 to cache universal group memberships by using the Active Directory Sites and Services snap-in.

讓通用登入,就不需要在每個網站使用網路頻寬最小化,因為網域控制站不需要複製所有位於森林中的物件網域中的通用伺服器。Enabling universal group membership caching eliminates the need for a global catalog server at every site in a domain, which minimizes network bandwidth usage because a domain controller does not need to replicate all of the objects located in the forest. 它也會降低登入時間因為驗證網域控制站不一定需要存取通用取得通用群組成員資格資訊。It also reduces logon times because the authenticating domain controllers do not always need to access a global catalog to obtain universal group membership information. 如需有關使用通用群組成員資格快取的時機,請查看規劃全球 Catalog 伺服器位置For more information about when to use universal group membership caching, see Planning Global Catalog Server Placement.