The KKC (Knowledge Consistency Checker)

The KKC (Knowledge Consistency Checker) is a build in process which creates the replication topology in active directory Forest. By default the KCC runs every 15 minute intervals and dictates the replication routes from a domain controller to another DC. To make it simpler, if you have a domain controller in site-B and you have created a user here. The user object is going to be added .DIT database on this domain controller. IF there is a domain controller on Site-A and they are not able to see the user object created on Site-B, this is because the replication is not happening form Site-B domain controller to the Site-A domain controller. There might ne number of different reasons why KCC cannot or don't want to create the KCC connection from site-B to Site-A. Thumb of rule is the figured out what culprit is.

Creating manual connections might save the day. The issue regarding AD replication might be connected to Exchange. A user go created the RUS is not stamping the user; therefore SMTP Proxy address never gets generated.

Note: Microsoft does not recommend creating manual connections, since KCC is automated process and design to figured out the best path for replication, Microsoft recommends

To create a manual connection goes to site and services, Extend Site, click server object, select NTDS settings

• Make a right click
  
• New active directory connection
  
• Select a domain controller from the list, click ok and finish.
  

Wait for changes gets replication in the AD topology. On the connector and choose replicate now.

The Purpose of KCC

Data integrity is maintained by tracking changes on each domain controller and updating other domain controllers in a systematic way. Active Directory replication uses a connection topology that is created automatically, which makes optimal use of beneficial network connections and frees the administrators from having to make such decisions.

What replicates with KCC?

• Each combination of directory partitions that must be replicated
  
• Domain controllers that store the same domain directory partition must have connections to each other
  
• all domain controllers must be able to replicate the schema and configuration directory partitions
  

The routes for the following combinations of directory partitions are aggregated to arrive at the overall topology

• Configuration and schema within a site.
  
• Each domain directory partition within a site.
  
• Global Catalog read-only, partial directory partitions within a site.
  
• Configuration and schema between sites.
  
• Each domain directory partition between sites.
  
• Global Catalog read-only, partial directory partitions between sites.
  

Terminology with KCC

• KCC runs every 15 minutes.
  
• The domain controllers that replicate directly with each other are called replication partners
  
• these partnerships are added, removed, or modified automatically, as necessary, on the basis of what domain controllers are available and how close they are to each other on the network
  
• KCC creates connections that enable domain controllers to replicate with each other
  
• A connection defines a one-way, inbound route
  
• Connection objects are created automatically by the KCC; they can also be created manually.
  
• Site Links
  

  For replication to occur between two sites, a link must be established between the sites. Site links are not generated automatically and can be created in Active Directory Sites and Services. Unless a site link is in place, the KCC cannot create connections automatically between computers in the two sites, and replication between the sites cannot take place. Each site link contains the schedule that determines when replication can occur between the sites that it connects. The Active Directory Sites and Services user interface guarantees that every site is placed in at least one site link. A site link can contain more than two sites, in which case all the sites are equally well connected
  

• Bridgehead Servers
  

  To communicate across site links, the KCC automatically designates a single server, called the bridgehead server, in each site to perform site-to-site replication. Subsequent replication occurs by replication within a site. When you establish site links, you can designate the bridgehead servers that you want to receive replication between sites. By designating a specific server to receive replication between sites, rather than using any available server, you can specify the most beneficial conditions for the connection between sites. Bridgehead servers ensure that most replication occurs within sites rather than between sites.
  

Best,

Oz ozugurlu

BlackBerry restart services in RDC order

Here is the correct way of starting blackberry services. (RDC), the rest of the services can be restarted on any order after following the RDC rule.Restart the Black Berry Services in this order below

• Router
  Dispatcher
  Controller

Blackberry Router		Service establishes connections, Manages the connection to the wireless network for the BlackBerry Enterprise Server. Also routes data to handhelds that are connected through the BlackBerry Handheld Manager.
BlackBerry Dispatcher		Establish connection to Exchange, Performs data encryption and compression services for all data that the BlackBerry Enterprise Server sends or receives.
Controller		Controls all other services, Monitors key BlackBerry Enterprise Server components and restarts them if they stop responding.

Other services can be started in any order,

BlackBerry Alert		When configured, sends alerts when events at the specified level occur on the BlackBerry Enterprise Server.
BlackBerry attachment		Converts attachments into a format that can be viewed on the handheld.
BlackBerry Database Consistency Service		Synchronizes data between the BlackBerry Manager database and user mailboxes.
Blackberry Mobil data service		Provides secure access to online content and applications on the corporate intranet or Internet through the BlackBerry Enterprise Server.
BlackBerry Policy service		Supports wireless IT Policy, service books, and third-party application delivery for the BlackBerry Enterprise Server.
BlackBerry Synchronization service		Synchronizes PIM application data wirelessly between the handheld and the mail Server.

Best,

Oz oozugurlu

BlackBerry How to test mail flow on Users Handheld

Here is the situation, users calls and complain not getting messages to their handheld. Most of the time there is a problem with either BlackBerry or the wireless provider. Time to time the problem is cause by end user. If this is the case how we can identify the message is getting to handheld even though we don't have the handheld in front of us. Here is nice trick we learned from RIM support.

Problem: user is assuming not getting mail to this handheld

Solution: Generate Automatic confirmation e-mail to determine if test mail ever makes the handheld

From your outlook compose a new mail message to the user who is having trouble as shown below

Do not forget the brackets on the Subject line, and ask the user to reply the message.

• To : Effected user
  
• Subject: <Confirm>
  

This is going to generate automatic mail reply back to you as soon as the message hits the user handheld with subject line "BlackBerry Delivery Confirmation" and some details in the body of the confirmation e-mail

I think this is real slick

Best

Oz

Defragging Active Directory .DIT Database

What are the reasons, why we would ever need to defrag .DIT database. In my case the DC (domain Controller) going out of space on C drive, and there is a little space letf on the other available drive.The other important reason in this case, the DC having big replication issues , and .DIT database seems to be reached 6GIG in size, Although , other DC's have .DIT database size in 2GIG.If you remember I have mentioned many times in my previous articles about , .DIT database, Which is partitioned database. How does Exchange related to .DIT database. Exchange Utilizes all partitions in the .DIT database. The partitions in the .DIT database follows as below.

• Domain
  
• Configuration
  
• Schema
  
• Application ( .DIT 2003 Only)
  

In my example the DC , which is having heavy replication problems need defragmetation on the .DIT database. You may ask yourself why .DIT database reached 6GIG ( the actual size o fthe .DIT database is less than 1GIG) on this Domain Controller.

Lets take a look a little closer the reasons. DLT objects (Distributed Link Tracking) in active directory.

• Distributed Link Tracking is a service that was introduced in Windows 2000 and is now also available in Windows XP and .NET servers (including the most recent post beta-3 release). The service was intended to resolve problems with outdated shortcuts. These problems applied to both shell shortcuts (such as ones located in Desktop, Favorites, Start Menu, and Recent folders) as well as OLE application links (such as an Excel spreadsheet stored within a Word document)
  
• Dltpurge.vbs (Q315229)
  
• You can use the Distributed Link Tracking Server service and the Distributed Link Tracking Client service to track links to files on NTFS-formatted partitions. Distributed Link Tracking tracks links in scenarios where the link is made to a file on an NTFS volume, such as shell shortcuts and OLE links. If that file is renamed, moved to another volume on the same computer, moved to another computer, or moved in other similar scenarios, Windows uses Distributed Link Tracking to find the file. When you access a link that has moved, Distributed Link Tracking locates the link; you are unaware that the file has moved, or that Distributed Link Tracking is used to find the moved file.
  
• Distributed Link Tracking consists of a client service and a server service. The Distributed Link Tracking Server service runs exclusively on Windows Server-based domain controllers. It stores information in Active Directory, and it provides services to help the Distributed Link Tracking Client service. The Distributed Link Tracking Client service runs on all Windows 2000-based and Microsoft Windows XP-based computers, including those in workgroup environments or those that are not in a workgroup. It provides the sole interaction with Distributed Link Tracking servers.
  
  Distributed Link Tracking clients occasionally provide the Distributed Link Tracking Server service with information about file links, which the Distributed Link Tracking Server service stores in Active Directory. Distributed Link Tracking clients also may query the Distributed Link Tracking Server service for that information when a shell shortcut or an OLE link cannot be resolved. Distributed Link Tracking clients prompt the Distributed Link Tracking server to update links every 30 days. The Distributed Link Tracking Server service scavenges objects that have not been updated in 90 days
  
  When a file that is referenced by a link is moved to another volume (on the same computer or on a different computer), the Distributed Link Tracking client notifies the Distributed Link Tracking server, which creates a linkTrackOMTEntry object in Active Directory. A linkTrackVolEntry object is created in Active Directory for every NTFS volume in the domain.
  

What Microsoft recommends for the DLT in windows 2000 based servers

• Turn off the Distributed Link Tracking Server service on all domain controllers (this is the default configuration on all Windows Server 2003-based servers).
  

Notes:

• The Directory Information Tree (DIT) size on domain controllers is not reduced until the following actions are completed
  
• Deleted objects are stored in the Deleted Objects container until the tombstone lifetime expires. The default value for a tombstone lifetime is 60 days, the minimum value is 2 days, and the minimum value that is recommended by Microsoft for production domains is 30 to 45 days
  
• Garbage collection has run to completion
  
• You use Ntdsutil.exe to defragment the Ntds.dit file in Dsrepair mode
  

How to defrag The Directory Information Tree (DIT) database.

Before , I get to this you must read following articles

A sample customer experience , it is so unbelivable the place I work currenlty is 4 times worst than , what Microsoft talks about in the article. Seriousily thre DL object in one domain exides 379.000 DLT object in my case.

Anatomy of DLT object deletion

DLT objects themselves contain very few attributes and use very little space in Active Directory. When an object is marked for deletion (tombstoned), all the unnecessary attributes are stripped away, except for those necessary to track the object until it is purged from Active Directory.

In the case of the link-tracking objects, marking the object for deletion only amounts to two attributes being removed: dscorepropagationdata and objectcategory. The deletion of the two attributes results in an initial savings of 34 bytes. However, the process of marking the link-tracking object for deletion also updates the object by adding an IS_DELETED attribute (4 bytes), and by mangling the RDN and the "common name" attributes, causing each of those attributes to grow by about 80 bytes. In addition, the "replication metadata" attribute also grows by about 50 bytes to reflect the updates performed on this object. So, by marking a link-tracking object for deletion, the object will end up growing by approximately 200 bytes. The NTDS.DIT will not exhibit a reduction in size until the deleted objects have tombstoned, been garbage collected and an offline defragmentation performed.

Steps

1. Rebot the server , Press F8 and select Directory Services Restore Mode option.
   
2. Use Administrator account to get in to Directory services restore mode.
   
3. This is special mode, the .DIT database if isolated from multi master replication model theory
   
4. Go to Command line, any type
   
5. NTDSUTIL ( enter)
   
6. Files
   
7. File maintanace: compact to c:\temp (Enter)
   
8. Watch the bar similar Exchange Defragmentation process
   
9. copy c:\temp\ntds.dit %systemroot%\ntds\ntds.dit ( you woulod think window would do it autimaticly , just like in exchange, but you have to perform this manually
   
10. restart the Domain Controller
    

Regards,

Oz ozugurlu