Plan Active Directory Sites and Services for Branch Offices

Admin

October 7, 2026

8 min read

Active Directory sites describe well-connected parts of a network. Domain-joined clients use their IP subnet mapping to find a nearby domain controller, while site links describe the logical paths and schedules the Knowledge Consistency Checker (KCC) uses to build intersite replication connections.

See the Current DC-to-Site Mapping

Inventory

Start with the domain controllers and their current site assignments. Confirm that each DC’s site matches its physical network location before planning any new site objects.

Get-ADDomainController -Filter * |
  Sort-Object Site, HostName |
  Select-Object HostName, IPv4Address, Site, IsGlobalCatalog

❯ Illustrative Output (Results Vary)

HostName                  IPv4Address  Site         IsGlobalCatalog
DC-HUB-01.corp.example.com 10.20.0.10  HQ           True
DC-BR-01.corp.example.com  10.40.0.10  Branch-East  True

Find Missing, Overlapping, or Misassigned Subnets

Subnet Mapping

Every client network that should map to a site needs the correct network prefix associated with that site. Compare the AD objects with the network team’s routed subnet list. A missing or overly broad prefix can cause clients to select a DC across a WAN link.

Get-ADReplicationSubnet -Filter * -Properties Site |
  Sort-Object Name |
  Select-Object Name, Site

❯ Illustrative Output (Results Vary)

Name          Site
10.20.0.0/16  CN=HQ,CN=Sites,CN=Configuration,DC=corp,DC=example,DC=com
10.40.0.0/16  CN=Branch-East,CN=Sites,CN=Configuration,DC=corp,DC=example,DC=com

Inspect Site Link Membership, Cost, and Schedule

WAN Design

Site links are logical replication paths, not a map of every router hop. Check which sites are included, the assigned cost, replication interval, and schedule. Costs should reflect the relative preference you intend, and schedules should meet the business requirement for change convergence without overloading constrained links.

Get-ADReplicationSiteLink -Filter * -Properties Cost, SitesIncluded, ReplicationFrequencyInMinutes |
  Select-Object Name, Cost, ReplicationFrequencyInMinutes, SitesIncluded

Check the Site Reported by a Branch Client

Client Validation

After an approved subnet mapping change has replicated, test from a representative client on each affected network. The site reported by Netlogon should match the intended location; then check which DC the client discovers. Run validation on both wired and VPN networks if they use different address pools.

nltest /dsgetsite
nltest /dsgetdc:corp.example.com

Apply One Approved Change and Validate

Rollout

Document the previous mapping and site-link settings, then change one approved site or subnet at a time. Allow the configuration partition to replicate and validate site discovery from a client on the affected subnet. Do not add redundant site links just because the physical network has alternate router paths; site links represent replication policy. If a branch has no local DC, verify WAN, DNS, and logon behavior for clients using a remote DC.

# Run from an affected branch client after the approved change replicates.
nltest /dsgetsite
nltest /dsgetdc:corp.example.com

# Run from an administrative host to check the affected DCs.
repadmin /replsummary
repadmin /showrepl DC-BR-01