Active Directory sites and replication

Start DC01, DC02 and CL01. Work on DC01 as SAATLAB\adm.rahul in PowerShell as administrator.

1Rename the default site and add its subnet

On DC01:

Get-ADReplicationSite -Filter * | Select-Object Name
Rename-ADObject (Get-ADReplicationSite 'Default-First-Site-Name').DistinguishedName -NewName HQ
New-ADReplicationSubnet -Name '10.0.0.0/24' -Site HQ -Location 'Head office'
Get-ADReplicationSite -Filter * | Select-Object Name

You should see something like this:

Name
----
Default-First-Site-Name

Name
----
HQ

Renaming the default site is safe and common. Every DC and site link that referenced it follows the rename, because AD links objects by their identity, not their name.

✅ Checkpoint: The only site is now called HQ and it owns the 10.0.0.0/24 subnet.

2Create the Branch site, its subnets and a site link

On DC01:

New-ADReplicationSite -Name Branch -Description 'Branch office'
New-ADReplicationSubnet -Name '10.0.0.11/32' -Site Branch -Location 'Branch DC'
New-ADReplicationSubnet -Name '10.0.0.128/26' -Site Branch -Location 'Branch clients'
New-ADReplicationSiteLink -Name 'HQ-Branch' -SitesIncluded HQ, Branch -Cost 100 -ReplicationFrequencyInMinutes 15 -InterSiteTransportProtocol IP
Get-ADReplicationSubnet -Filter * | Select-Object Name, @{n='Site';e={($_.Site -split ',')[0] -replace 'CN='}}
Get-ADReplicationSiteLink -Filter * | Select-Object Name, Cost, ReplicationFrequencyInMinutes

You should see something like this:

Name          Site
----          ----
10.0.0.0/24   HQ
10.0.0.11/32  Branch
10.0.0.128/26 Branch

Name              Cost ReplicationFrequencyInMinutes
----              ---- -----------------------------
DEFAULTIPSITELINK  100                           180
HQ-Branch          100                            15

DEFAULTIPSITELINK still contains only HQ. HQ-Branch is the link replication will use, every 15 minutes instead of the default 180.

✅ Checkpoint: Three subnets exist, two in Branch, and HQ-Branch replicates every 15 minutes.

3Move DC02 to the Branch site

On DC01:

Move-ADDirectoryServer -Identity DC02 -Site Branch
Get-ADDomainController -Filter * | Select-Object Name, IPv4Address, Site

You should see something like this:

Name IPv4Address Site
---- ----------- ----
DC01 10.0.0.10   HQ
DC02 10.0.0.11   Branch

Restart DC02 (or wait) so its Netlogon service re-registers DNS records for the Branch site, such as _ldap._tcp.Branch._sites.dc._msdcs.saatlab.internal. Clients in Branch use those records to find DC02 first.

After DC02 restarts, on DC01:

Resolve-DnsName -Type SRV _ldap._tcp.Branch._sites.dc._msdcs.saatlab.internal | Select-Object NameTarget

You should see something like this:

NameTarget
----------
DC02.saatlab.internal

✅ Checkpoint: DC02 shows Site Branch, and the Branch SRV record points to DC02.

4Check which site and DC CL01 uses

On CL01 (any user), restart Netlogon as admin or just restart CL01, then:

nltest /dsgetsite
nltest /dsgetdc:saatlab.internal | Select-String 'DC:|Dc Site Name|Our Site Name'

You should see something like this:

Branch
The command completed successfully
           DC: \\DC02.saatlab.internal
 Dc Site Name: Branch
Our Site Name: Branch

CL01’s address 10.0.0.150 falls in 10.0.0.128/26, the most specific match, so it’s in Branch and picks DC02. If DC02 went down, CL01 would fall back to a DC in another site.

✅ Checkpoint: CL01 reports site Branch and uses DC02.

5Watch and force replication

On DC01, look at the connections the KCC built and DC02’s inbound replication:

repadmin /kcc DC02
Get-ADReplicationConnection -Filter * -Server DC02 | Select-Object @{n='From';e={($_.ReplicateFromDirectoryServer -split ',')[1] -replace 'CN='}}, AutoGenerated
repadmin /showrepl DC02

You should see something like this (shortened):

From AutoGenerated
---- -------------
DC01          True

Branch\DC02
DSA Options: IS_GC
Site Options: (none)
...
==== INBOUND NEIGHBORS ======================================

DC=saatlab,DC=internal
    HQ\DC01 via RPC
        DSA object GUID: 5b1f...
        Last attempt @ 2026-10-19 22:51:12 was successful.

Now create a user on DC01 and push it to DC02 without waiting 15 minutes:

New-ADUser -Name 'Site Test' -SamAccountName site.test -Path 'OU=Sales,OU=Staff,OU=SAATLAB,DC=saatlab,DC=internal'
Get-ADUser site.test -Server DC02 -ErrorAction SilentlyContinue | Select-Object Name
repadmin /syncall DC01 /AdeP
Get-ADUser site.test -Server DC02 | Select-Object Name

You should see something like this:

CALLBACK MESSAGE: The following replication is in progress:
    From: 5b1f...._msdcs.saatlab.internal
    To  : 9e2c...._msdcs.saatlab.internal
CALLBACK MESSAGE: The following replication completed successfully:
...
CALLBACK MESSAGE: SyncAll Finished.
SyncAll terminated with no errors.

Name
----
Site Test

The first lookup on DC02 returned nothing because the change hadn’t crossed the site link yet. /syncall with /AdeP pushes (P) all partitions (A) across sites (e) by DN (d). Remove the test user afterwards with Remove-ADUser site.test -Confirm:$false.

✅ Checkpoint: site.test was missing on DC02, then present after repadmin /syncall finished with no errors.