10 NTDS Settings Best Practices

NTDS (NT Domain Services) settings are a set of configuration options that control how the Windows NT Domain Services (NTDS) system works. These settings are important for ensuring that the NTDS system is secure and efficient.

In this article, we will discuss 10 best practices for configuring NTDS settings. We will cover topics such as password policies, account lockout policies, and auditing settings. By following these best practices, you can ensure that your NTDS system is secure and running optimally.

1. Remove the NTDS Settings object from all DCs except one

The NTDS Settings object contains the replication configuration for a domain controller. If it is present on multiple DCs, then they will all attempt to replicate with each other and this can cause conflicts.

To avoid these issues, make sure that only one DC has the NTDS Settings object. This should be the primary DC in your environment. You can remove the NTDS Settings object from other DCs by using the Active Directory Sites and Services console or PowerShell cmdlets.

2. Set the NTDS Settings object to point to itself as its own bridgehead server

When a domain controller replicates with other domain controllers, it needs to know which one is the bridgehead server. The bridgehead server is responsible for managing replication traffic between two sites. By setting the NTDS Settings object to point to itself as its own bridgehead server, you ensure that all replication traffic is managed by the same domain controller. This helps reduce network congestion and ensures that replication traffic is handled efficiently.

3. Ensure that the NTDS Settings object is not a global catalog server

A global catalog server is a domain controller that stores a full copy of all objects in the directory for its host domain and a partial, read-only replica of all objects from other domains in the forest. This means that if an NTDS Settings object is also a global catalog server, it will contain sensitive information about users and resources across multiple domains.

To prevent this, make sure to configure your NTDS Settings object as a non-global catalog server. This can be done by disabling the Global Catalog checkbox on the NTDS Settings object’s Properties page.

4. Change the site link schedule to reflect your organization’s business needs

The site link schedule determines how often replication occurs between sites. If the schedule is too frequent, it can cause unnecessary network traffic and slow down performance. On the other hand, if the schedule is not frequent enough, changes made in one site may take a long time to replicate to another site.

By changing the site link schedule to reflect your organization’s business needs, you can ensure that replication occurs at an optimal frequency. This will help keep your network running smoothly and efficiently while also ensuring that data is up-to-date across all sites.

5. Create additional site links if necessary

Site links are used to connect two or more sites in a network, and they’re essential for replication. If you don’t have enough site links, then the replication process can be slow and unreliable.

Creating additional site links is also important because it allows you to control how data is replicated between different sites. For example, if you want certain types of data to replicate faster than others, you can create separate site links for each type of data. This will ensure that the most important data replicates quickly and reliably.

6. Configure replication schedules for each site link based on network traffic patterns

When configuring replication schedules, it’s important to consider the amount of network traffic that will be generated by each site link. If you configure a schedule that is too frequent, then you may end up with unnecessary network traffic and performance issues. On the other hand, if you configure a schedule that is too infrequent, then your data won’t be replicated in a timely manner.

By taking into account the amount of network traffic that will be generated by each site link, you can ensure that your replication schedules are configured appropriately. This will help ensure that your data is being replicated efficiently and effectively without causing any unnecessary network traffic or performance issues.

7. Disable automatic site coverage

When automatic site coverage is enabled, the domain controller will automatically replicate data to other sites in the network. This can cause unnecessary replication traffic and slow down your network performance. Additionally, it can lead to inconsistent data across multiple sites if not managed properly.

To avoid these issues, you should disable automatic site coverage and manually configure which sites need to be replicated. This way, you have more control over how much data is being replicated and where it’s going. It also allows you to better manage bandwidth usage and ensure that only necessary data is being sent between sites.

8. Enable change notification on all intersite connections

Change notification is a feature that allows domain controllers to communicate with each other when changes are made in Active Directory. This helps ensure that all domain controllers have the same information and that any changes are replicated quickly across the network. Without change notification, replication can take longer and cause problems if one domain controller has outdated information.

Enabling change notification on intersite connections ensures that all domain controllers stay up-to-date and reduces the risk of data loss or corruption due to out-of-sync replicas. It also helps improve performance by reducing the amount of time it takes for changes to be propagated throughout the network.

9. Use intrasite compression for slow WAN links

Intrasite compression reduces the amount of data that needs to be sent over a WAN link, which can significantly improve performance. This is especially important for slow links, as it helps reduce latency and ensure that replication occurs quickly and efficiently. Additionally, intrasite compression also helps reduce bandwidth usage, which can help save money on network costs.

10. Use universal group caching for sites with low bandwidth and high latency

Universal group caching allows domain controllers to cache universal groups, which are used for authentication and authorization. This means that when a user logs in, the domain controller can quickly access the cached information instead of having to wait for it to be retrieved from another site over the network. This helps reduce login times and improves overall performance. Additionally, this feature is especially useful for sites with low bandwidth or high latency, as it reduces the amount of data being transferred across the network.