Active Directory Sites and Services

What Is Active Directory Sites and Services?

Active Directory Sites and Services is the MMC snap-in — and the set of directory objects behind it — used to describe your organisation’s physical network topology to Active Directory. Every domain controller lives somewhere on a real network, connected to other locations by links of very different quality: a gigabit LAN in one building, a modest WAN circuit between two offices, a satellite link to a remote site. Active Directory has no way to infer any of that on its own, so an administrator tells it, using sites, subnets, and site links.

Think of it as the map an airline uses to decide flight routes. Cities are sites. The routes between them are site links, each with its own cost and timetable. A direct low-cost route gets used first; a connection that only runs a few times a day still gets used when nothing better is scheduled. Active Directory replication works the same way — it is only as efficient as the map you give it.

The three core objects are sites, subnets, and site links. A site groups subnets that are well connected to each other, almost always meaning “the same building or campus.” A subnet object (in CIDR form, such as 10.20.30.0/24) is associated with exactly one site, so any computer whose IP address falls in that range — a domain controller or an ordinary client — is treated as being physically located there. A site link then joins two or more sites and describes the cost and schedule of the connection between them.

How Site Topology Drives Replication

Nobody manually creates the connections domain controllers replicate over. A background process called the Knowledge Consistency Checker (KCC) runs on every domain controller and builds that automatically, recalculating on a fixed interval — every 15 minutes by default — and immediately after a manual trigger.

Inside a site, the KCC arranges domain controllers into a bidirectional ring, with extra shortcut connections added in larger sites to keep replication latency down. Between sites, the picture is different: bandwidth is assumed to be scarcer, so the KCC builds a least-cost spanning tree instead of a ring, using exactly the site links and costs you have defined. One domain controller in each site — a bridgehead server — is selected to carry replication traffic across the site link on behalf of the rest of that site’s domain controllers, which then pick it up locally over ordinary intrasite replication.

Why the Rest of the Network Depends on This

Site topology is not only about replication traffic. When a client — a workstation, a member server, or another domain controller — needs to find a domain controller to authenticate against, the domain controller locator process (DsGetDcName) checks which site the client’s own IP address falls into and prefers a domain controller in that same site first. Get the subnet-to-site mapping wrong, or leave a subnet unmapped, and every affected client falls back to whichever domain controller answers fastest, anywhere in the forest — often across a WAN link, with the latency and logon delays to match.

This is also the layer that keeps replication bandwidth under control. Intrasite replication assumes a fast LAN and uses immediate change notification — a domain controller that just wrote a change waits roughly 15 seconds and then notifies its first replication partner, three seconds between each subsequent partner. Intersite replication makes the opposite assumption: WAN links are precious, so by default it only runs once every 180 minutes per site link, and the traffic that does cross a site link is compressed before it goes.

The Console and Where It Lives

Active Directory Sites and Services is opened as dssite.msc, or from Server Manager’s Tools menu on a domain controller, where it is installed automatically as part of the AD DS role. To manage it from a non-DC administrative workstation, install the AD DS and AD LDS Tools feature of Remote Server Administration Tools:

# Install the AD DS/AD LDS RSAT tools, including the Sites and Services snap-in,
# on a member server or admin workstation that is not itself a domain controller
Install-WindowsFeature -Name RSAT-AD-Tools -IncludeAllSubFeature

The console and its underlying object model have been part of Active Directory since Windows 2000 Server and have not been reshaped since — sites, subnets, site links, and the KCC work the same way on Windows Server 2025 as they did two decades ago. What has changed is around the edges: Windows Server 2008 introduced read-only domain controllers and a KCC improvement for hub-and-spoke branch topologies (governed by the Random BH Loadbalancing Allowed registry value under NTDS\Parameters, enabled by default), and Microsoft has flagged SMTP as a replication transport for retirement — new deployments should stick to RPC over IP, which is also the only transport that replicates domain-partition data rather than just schema, configuration, and the global catalog.

Configuring Sites, Subnets, and Site Links

In the console, sites live under the Sites container, subnets under Sites → Subnets, and site links under Sites → Inter-Site Transports → IP (or SMTP, if that legacy transport container has been enabled). Creating each object by hand is a right-click → New away, but the sequence matters: create the sites first, then the subnets that map to them, then the site links that connect the sites together.

The equivalent PowerShell, using the ActiveDirectory module, is usually faster once you have more than a handful of sites to create — and it is what most automation ends up using, since the console has no bulk-import path of its own.

PowerShell and repadmin Commands

# Create a new site for a physical location
New-ADReplicationSite -Name "Bengaluru" -Description "Primary DC site - Bengaluru DC"

# Map a subnet to that site (subnet name must be in CIDR form)
New-ADReplicationSubnet -Name "10.20.30.0/24" -Site "Bengaluru"

# Create a site link between two sites, with a cost and a 15-minute replication interval
New-ADReplicationSiteLink -Name "Bengaluru-Chennai" -SitesIncluded Bengaluru,Chennai `
  -Cost 100 -ReplicationFrequencyInMinutes 15 -InterSiteTransportProtocol IP

# Add a third site to that same site link without re-listing the existing sites
Set-ADReplicationSiteLink -Identity "Bengaluru-Chennai" -SitesIncluded @{Add="Mumbai"}

# Lower the cost and tighten the schedule on an existing site link
Set-ADReplicationSiteLink -Identity "Bengaluru-Chennai" -Cost 50 -ReplicationFrequencyInMinutes 30

# Enable change notification on a site link so it behaves closer to intrasite replication
Set-ADReplicationSiteLink -Identity "Bengaluru-Chennai" -Replace @{'options'=1}

# List every site link with its cost and replication frequency
Get-ADReplicationSiteLink -Filter * -Properties Cost,ReplicationFrequencyInMinutes |
  Format-Table Name,Cost,ReplicationFrequencyInMinutes -AutoSize

# Force the KCC to recalculate the replication topology right now instead of waiting 15 minutes
repadmin /kcc

# Summarise replication health across every domain controller and partition
repadmin /replsummary

# Dump full replication link state for every DC to a CSV for review
repadmin /showrepl * /csv > repl.csv

# View (and optionally set) the intrasite change-notification delays for a partition
repadmin /notifyopt DC01 dc=corp,dc=example,dc=com /first:5 /sub:3

Schedule and Cost Reference

A handful of numbers come up in almost every site-link conversation. Knowing which ones are defaults and which are guidance saves a lot of second-guessing during a design review.

Troubleshooting Cheat Sheet

Final Thoughts

Sites and Services rarely gets attention during initial deployment, because a single-site lab or a small office works fine with almost no topology at all — one site, no interesting site links, replication happening constantly because there is nothing to schedule. The gaps show up later, when a second office opens, a branch gets its own subnet, or a WAN circuit that used to be adequate starts to strain.

Treat the site topology as living documentation of your network, not a one-time setup task. Every new subnet deserves a site mapping, every new WAN circuit deserves a look at whether it should be its own site link or fold into an existing one, and every replication complaint is worth checking against repadmin /replsummary before assuming the problem is anywhere more exotic.