💡 Setting instant replication over manually created connections
There is one more thing to know here thou. When you set up site links manually above option doesn't apply. It only applies to those created automatically. In my case, I've three additional connections created manually for this particular DC that and we need to treat it separately.
When you follow this blog post, go thru the code before running this in production. It changes things. Review the code, run read-only commands first and confirm you see what you're supposed to see. While I've made an effort to be accurate here, if you don't feel confident in what you do, ask some Senior Admin to help you.
As you see on the above screenshot only that automatically generated connection is affected by global change, we did above. If we want things to work for us, we need to change settings for all other links to different values.
We have to find their path in ADSI Edit and modify their value. But this time it's a bit more complicated because you would need to go thru each connection and change its Options value. Remember how I told you that the value needs to replace with BitOR to 1. Well, in this case, it's a different value.
In this case, number 1 means IS_GENERATED. Rest of the connections has 0 in options, which means they will respect the global replication interval (not the USE_NOTIFY thou). Things get even more complicated with RODC.
Value 0x41 (IS_Generated | RODC_Topology) gives us the number value 65. In this case, our Values mean RODC_Topology is 64, and IS_Generated is 1. In case you would find other Values here, you always need to make do that calculation yourself. Following Microsoft post contains all Values available. Since I don't want to go manually thru every connection, let's try to find some information about all our connections using PowerShell. I've written simple function Get-WinADSiteConnections which does some small cleanup over Get-ADObject results and delivers an excellent overview of those in a single view.
function Get-WinADSiteConnections {
[CmdletBinding()]
param(
)
[Flags()]
enum ConnectionOption {
None
IsGenerated
TwoWaySync
OverrideNotifyDefault = 4
UseNotify = 8
DisableIntersiteCompression = 16
UserOwnedSchedule = 32
RodcTopology = 64
}
$NamingContext = (Get-ADRootDSE).configurationNamingContext
$Connections = Get-ADObject –Searchbase $NamingContext -LDAPFilter "(objectCategory=ntDSConnection)" -Properties *
$FormmatedConnections = foreach ($_ in $Connections) {
$Dictionary = [PSCustomObject] @{
<# Regex extracts AD1 and AD2
CN=d1695d10-8d24-41db-bb0f-2963e2c7dfcd,CN=NTDS Settings,CN=AD1,CN=Servers,CN=KATOWICE-1,CN=Sites,CN=Configuration,DC=ad,DC=evotec,DC=xyz
CN=NTDS Settings,CN=AD2,CN=Servers,CN=KATOWICE-1,CN=Sites,CN=Configuration,DC=ad,DC=evotec,DC=xyz
#>
CN = $_.CN
Description = $_.Description
DisplayName = $_.DisplayName
EnabledConnection = $_.enabledConnection
ServerFrom = if ($_.fromServer -match '(?<=CN=NTDS Settings,CN=)(.*)(?=,CN=Servers,)') {
$Matches[0]
} else {
$_.fromServer
}
ServerTo = if ($_.DistinguishedName -match '(?<=CN=NTDS Settings,CN=)(.*)(?=,CN=Servers,)') {
$Matches[0]
} else {
$_.fromServer
}
<# Regex extracts KATOWICE-1
CN=d1695d10-8d24-41db-bb0f-2963e2c7dfcd,CN=NTDS Settings,CN=AD1,CN=Servers,CN=KATOWICE-1,CN=Sites,CN=Configuration,DC=ad,DC=evotec,DC=xyz
CN=NTDS Settings,CN=AD2,CN=Servers,CN=KATOWICE-1,CN=Sites,CN=Configuration,DC=ad,DC=evotec,DC=xyz
#>
SiteFrom = if ($_.fromServer -match '(?<=,CN=Servers,CN=)(.*)(?=,CN=Sites,CN=Configuration)') {
$Matches[0]
} else {
$_.fromServer
}
SiteTo = if ($_.DistinguishedName -match '(?<=,CN=Servers,CN=)(.*)(?=,CN=Sites,CN=Configuration)') {
$Matches[0]
} else {
$_.fromServer
}
OptionsTranslated = [ConnectionOption] $_.Options
Options = $_.Options
WhenCreated = $_.WhenCreated
WhenChanged = $_.WhenChanged
IsDeleted = $_.IsDeleted
}
$Dictionary
}
$FormmatedConnections
}
We can now clearly see all our connections and sites.
Now that we have our values, with full visibility of Options property, we can do a manual test and see how that changes. USE_Notify, which is responsible for the immediate notification process, has a value of 8. That means that for out RODC Connection we can change it from 65 to 73 and that should solve it.
Accurate result? Yes. But we don't want to do it manually, right?
When you follow this blog post, go thru the code before running this in production. It changes things. Review the code, run read-only commands first and confirm you see what you're supposed to see. While I've made an effort to be accurate here, if you don't feel confident in what you do, ask some Senior Admin to help you.
We can do automatic change with this little command
function Set-WinADReplicationConnections {
[CmdletBinding()]
param(
[switch] $Force
)
[Flags()]
enum ConnectionOption {
None
IsGenerated
TwoWaySync
OverrideNotifyDefault = 4
UseNotify = 8
DisableIntersiteCompression = 16
UserOwnedSchedule = 32
RodcTopology = 64
}
$NamingContext = (Get-ADRootDSE).configurationNamingContext
$Connections = Get-ADObject –Searchbase $NamingContext -LDAPFilter "(objectCategory=ntDSConnection)" -Properties *
foreach ($_ in $Connections) {
$OptionsTranslated = [ConnectionOption] $_.Options
if ($OptionsTranslated -like '*IsGenerated*' -and -not $Force) {
Write-Verbose "Set-WinADReplicationConnections - Skipping $($_.CN) automatically generated link"
} else {
Write-Verbose "Set-WinADReplicationConnections - Changing $($_.CN)"
Set-ADObject $_ –replace @{ options = $($_.options -bor 8) }
}
}
}
If we run this command above, it will go thru each of the connections and add that 8 value in there. If we rerun our Get-WinADSiteConnections function, we can confirm that Options values did change has changed to their instant, proper setting. Keep in mind it will only change links created manually and skip those that are auto-generated. If you want to force change on all you need to use Force switch.
