Another day. another question for all you MS gurus...

Active directory...

Is there any way to change the connection type for clients.. i know that DC replication can be selected to be over a "low speed" link.. but can something similar be done for clients authenticating on the domain?

both the DCs are here on our local network... but 90% of the clients are on a WAN which is only 128k.

so it can take up to 2 minutes to authenticate and log on. :eek:

cheers

Colin, I ain't any Active Dir guru by any means, so may not make any sense, but are you sure the 2 minutes are required just to authenticate?!?

Could it be roaming profiles are set up so all the IE favourites, cache, etc is copied across each time someone logs on? 2 minutes just to authenticate sounds crazy. There's got to be some bandwidth-hugging loggon script requiring that time, surely? :confused:

Are they all on the *same* 128K link? If so you need to seriously think about putting a DC at the other end of the line. (With good physical security especially when off site etc etc).

Also do a Google for "slow link detection" to find out if its possible to increase the number of times a logon uses cached information (and is therefore quicker).

No.. they are spread across 80-odd sites.

it was a rushed install.. and we didnt investigate the impact of running AD authentication over 128k... theres an existing NT4 layout running along side, this runs fine..

theres no logon scripts, they also use local profiles (it was just setup to give us control using group policy, we dont really use any other features of AD yet)

Are all the clients at a single remote site?

If so then you really should have a DC there.

Even if it's just a tatty old machine that you can lock in a cupboard and forget (no need to do backups really) then it's a much better idea than having all the logon traffic going across a slow link

Are all the clients at a single remote site?

If so then you really should have a DC there.

Even if it's just a tatty old machine that you can lock in a cupboard and forget (no need to do backups really) then it's a much better idea than having all the logon traffic going across a slow link

I think that's what I said ... but it turns out that there's more than one remote site.

In this case you might strongly consider a terminal services solution if you can't upgrade the links.

Terminal services won't be great over 128k either.

Still , if it's only a couple of machines per site , each with 128k then authentication shouldn't take 2 minutes to go through. How long does it take for machines on the main site to authenticate?

Are both DCs a global catalog server?

I think that's what I said ... but it turns out that there's more than one remote site.

In this case you might strongly consider a terminal services solution if you can't upgrade the links.

Our new IT manager seems to be pushing Terminal services in the near future..

Currently our branches have Dell NX1 (pcs with no cd/floppy drive) running a locked down NT4. and a webmail solution. all they are really needed for is running the POS client application and accessing webmail.

they all authenticate against a NT4 server domain..

but recently weve had an initiative to install 1 full-spec pc per branch.. so windows XP. again, 80 odd of these is pretty hard to control.. and the older NX1s are beginning to fail.. :thumbdwn:

new manager wants a networked lazer printer and 2 line printers per branch, all controlled centrally via active directory and terminal services.

Can they authenticate on to the NT domain and go in that way?

Can they authenticate on to the NT domain and go in that way?

No.. unfortunately they need server 2003 to distribute the "enhanced" xpSP2 group policy to stop them farking them up!

How about using BITS?

Or SMS to fire it out to local machines over night so they get it locally rather than over the link?

How about using BITS?

Or SMS to fire it out to local machines over night so they get it locally rather than over the link?

is BITS actually useable? i thought it was purely for windoze update..

we also have a windows update services server and scheduled download times for all the different sites..

In theory, you can use BITS for any form of async file transfer.....

So why can't the policy be fired to their machines and they then get the policy local rather than network?