Post #3472223
2026-06-29 15:47 UTC
I cannot believe it is the year of our noodly lord two thousand and twenty-six and yet I STILL have to do shit like:
* run Notepad as Administrator
* open C:\Windows\System32\drivers\etc\HOSTS
* tell fucking Notepad to show me all files
* add an entry for the AD domain that points directly to the LOCAL DC only
* save
... just to keep a member server from constantly trying to jump across VPN links every time it needs an AD token.
WHY the hell does AD not already prioritize subnet-local DCs?!
Replies (1)
-
@tw000@infosec.exchange 2026-06-29 15:54
@jimsalter@fosstodon.org In the MS model, you're meant to control this with Sites & Services (and Subnets). The DC locator process should then take over and prioritize local DCs, but remote DCs will still be occasionally checked. If you're in a scenario where specific remote DCs are unreachable, this turns into a slightly more complicated scenario that will involve editing the correctly building the sites and sitelinks, then either letting the domain reconfigure or forcing the KCC process.