Do you have multiple AD sites?

🔒 Secure Bits 💡

𝗗𝗼 𝘆𝗼𝘂 𝗵𝗮𝘃𝗲 𝗺𝘂𝗹𝘁𝗶𝗽𝗹𝗲 𝗔𝗗 𝘀𝗶𝘁𝗲𝘀?

Most companies do. And that is a good thing – especially if you have multiple datacenters, branches, or locations and you want proper DC selection and replication control.

But there is 𝗼𝗻𝗲 𝘀𝗺𝗮𝗹𝗹 𝗱𝗲𝘁𝗮𝗶𝗹 that many environments still run with:

➡️ Default intersite replication.

By default, Active Directory intersite replication is 𝗻𝗼𝘁 𝗶𝗻𝘀𝘁𝗮𝗻𝘁. And if you open Active Directory Sites and Services, you quickly find the annoying part:

⚠️ You 𝗰𝗮𝗻𝗻𝗼𝘁 set the replication interval lower than 𝟭𝟱 𝗺𝗶𝗻𝘂𝘁𝗲𝘀 in the GUI.

For many modern environments, that is not ideal. The network can usually handle faster replication, but admins still end up with the same questions:

▪️ “Has it replicated yet?”

▪️ “Can you see the change on your DC?”

▪️ “Let’s wait a few more minutes…”

Annoying? 𝗬𝗲𝘀.

🚨 But there is also a 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗮𝗻𝗴𝗹𝗲.

This replication behavior can create a condition where an attacker may abuse bad password attempt handling and PDC behavior to 𝗯𝘆𝗽𝗮𝘀𝘀 𝗮𝗰𝗰𝗼𝘂𝗻𝘁 𝗹𝗼𝗰𝗸𝗼𝘂𝘁 expectations across sites.

𝗜 𝗲𝘅𝗽𝗹𝗮𝗶𝗻 𝘁𝗵𝗶𝘀 exact finding in my Windows Infrastructure Security course – and right now, my biggest discount event is almost 𝗼𝘃𝗲𝗿, so you can still get the 𝗰𝗼𝘂𝗿𝘀𝗲 𝗳𝗿𝗼𝗺 $𝟲𝟬 until June 21 (link in the comments).

𝗕𝘂𝘁 𝘁𝗵𝗲 𝗶𝗺𝗽𝗼𝗿𝘁𝗮𝗻𝘁 𝗽𝗮𝗿𝘁 𝗶𝘀 𝘁𝗵𝗶𝘀:

➡️ You can make intersite replication behave like intrasite replication by enabling change notification on the site link.

❌ Not from the normal GUI.

✅ But through ADSI Edit.

𝗣𝗮𝘁𝗵: 𝘈𝘋𝘚𝘐𝘌𝘥𝘪𝘵.𝘮𝘴𝘤 > 𝘊𝘰𝘯𝘧𝘪𝘨𝘶𝘳𝘢𝘵𝘪𝘰𝘯 𝘱𝘢𝘳𝘵𝘪𝘵𝘪𝘰𝘯 > 𝘚𝘪𝘵𝘦𝘴 > 𝘐𝘯𝘵𝘦𝘳-𝘚𝘪𝘵𝘦 𝘛𝘳𝘢𝘯𝘴𝘱𝘰𝘳𝘵𝘴 > 𝘐𝘗 > 𝘋𝘌𝘍𝘈𝘜𝘓𝘛𝘚𝘐𝘛𝘌𝘓𝘐𝘕𝘒 > 𝘈𝘵𝘵𝘳𝘪𝘣𝘶𝘵𝘦 𝘌𝘥𝘪𝘵𝘰𝘳 > 𝘖𝘱𝘵𝘪𝘰𝘯𝘴 = 1

That enables change notification for that site link.

𝗥𝗲𝘀𝘂𝗹𝘁?

✅ Faster replication

✅ Less “has it replicated yet?” waiting

✅ Eliminated exposure to the lockout bypass scenario mentioned above

And no, this is not some shady unsupported trick. This configuration has been documented by Microsoft for years and I use it regularly in real environments.

𝗗𝗶𝗱 𝘆𝗼𝘂 𝗸𝗻𝗼𝘄 𝗮𝗯𝗼𝘂𝘁 𝘁𝗵𝗶𝘀 𝘀𝗲𝘁𝘁𝗶𝗻𝗴?