Site Replication Question

[tavie]

I have a quick question about replication between sites....I cannot find the info on MS website....

Question: If I setup another site, I know I must set the replication interval between the sites, but what about immediate changes in AD like account lockouts ?? If I unlock account in one site does the cahnge immediately replicate to the other ?????

 

[vbrocks]

I think within the site it's about 5 minutes and to other sites it is controlled by the interval.

 

[tavie]

So if an account is locked out in site B and you unlock the account from site A, then the account will not be unlocked until the replication cycle has occurred which could be several hours ???? That does not make sense....Now you have to keep track as to what user and machine accounts are in what site in order to administrate them.

 

[vbrocks]

If you need to you can force a replication right away..

 

[tavie]

Understood....But would'nt it be easier if there was a mandatory change in AD that and automated replication process would keep at least the accounts in sync.....That is bar far the smallest object in AD......

 

[vbrocks]

Let me check it out I will get back to you...

 

[vbrocks]

If the user is at the other site you can use AD Users and Computers to connect to another dc at the remote site and create the user account on that dc....This will allow them to log on immediately.

Also...

http://www.2000trainers.com/article.aspx?articleID=36&page=2

 

[mlichstein]

Account lockouts are urgently replicated, meaning they do not follow the change notification rules.

There used to be a problem with account unlocks not being urgently replicated. The attribute that is changed (lockoutTime) would not be urgently replicated when it was set back to zero. This was fixed in SP2.

However, the big caveat is that urgent replication only works within a site. You can enable change notification replication between sites. This is the type of replication that is used within a site and enables urgent replication. But enabling change notification between sites takes away the benefits of normal intersite replication, like scheduling and compression.

The best thing to do is to force a full replication after unlocking an account.

 

[vbrocks]

As well as create an account using AD users and computers connected to a remote dc, you can also unlock the account in the same manner....That way the remote site does not have to wait for replication.

 

[tavie]

vbrocks....Your last post is what I thought would need to happen, the problem is I am dealing with old Mainframe operators who vaguely understand Windows. Making this a routine for them could be cumbersome....Thanks for the info.....