Information Technology Reference
In-Depth Information
Figure 7-6
The Details tab of a GPO
Because the two components of a GPO are stored in different places on a domain controller, dif-
ferent methods are required to replicate GPOs to all domain controllers. GPCs, which are Active
Directory objects, are replicated during normal Active Directory replication. GPTs, located in the
Sysvol share, are replicated by using one of these methods:
•
File Replication Service (FRS)
—FRS is used when you have a mix of Windows Server
2008, Windows Server 2003, and Windows 2000 domain controllers.
•
Distributed File System Replication (DFSR)
—DFSR is used when all DCs are running
Windows Server 2008.
Of these two replication methods, DFSR is the more efficient and reliable. It's efficient
because it uses an algorithm called remote differential compression (RDC) in which only data
blocks that have changed are compressed and transferred across the network. DFSR is more reli-
able because of improvements in handling unexpected service shutdown that could corrupt data
and because it uses a multimaster replication scheme.
Because the GPC and GPT use different replication methods, they can become out of sync.
As mentioned, GPCs are replicated when Active Directory replication occurs. Between DCs in
the same site, this interval is about 15 seconds after a change occurs. Between DCs in different
sites, the interval is usually much longer—minutes or even hours. DFSR of the Sysvol share (and,
therefore, the GPT) occurs immediately after a change is made. Strange and unpredictable results
could occur when a client computer attempts to apply a GPO when the GPC and GPT aren't
synchronized. However, starting with Windows XP, the client computer checks the version
number of both components before applying GPO settings.
As long as replication services are running correctly, the most likely problem with GPO repli-
cation is a delay in clients receiving changes in policy settings. This problem usually occurs when
Search WWH ::
Custom Search