How DFS and AD Work Together

To understand some of the advantages of DFS and Active Directory (AD) integration, it helps to know how the two work together. AD stores information about the namespace servers and the namespace configuration as BLOBs in the domain partition at CN=Dfs-Configuration,CN=System,DC=domain,DC=generic top-level domain, which ensures that any client that can reach a domain controller (DC) can get information on a domain-based DFS namespace. Because DFS uses site information to find the nearest DFS replica, sites and subnets must be properly configured in AD before you configure DFS.

When a Windows client attempts to access a DFS folder, the client's Netlogon service first queries AD to determine the names of the namespace servers. Then, according to the AD site topology, Netlogon tries to contact the closest namespace server. A Windows Server 2003 improvement ensures that if no namespace server is available in the client's site, the client chooses the next-closest offsite server. This capability isn't enabled by default; however, you must run Dfsutil with the /SiteCosting switch to turn it on.

After the client has contacted the namespace server and the server has returned the namespace's folder structure, the user navigates through the folder structure to a folder target. The namespace server provides the referral to the network share to the client, which then establishes a session with the destination server just as if you'd typed a Net Use command. If multiple folder targets are enabled for the folder of interest, the client again uses the AD site topology to choose the closest network share.

You must not change the namespace configuration without letting AD know. If you have to change a DFS server's configuration—if you need to rename a server that is a root or folder target, for example—remove the server from the namespace first. Because server configuration changes aren't communicated to AD, AD continues to provide referrals to the old name. If you have no choice but to change a DFS server's configuration without removing it from the namespace (for example, if a server dies and isn't returned to service with the same name), run Dfsutil with the /clean parameter to remove the obsolete reference.

Sean writes about cloud identity, Microsoft hybrid identity, and whatever else he finds interesting at his blog on Enterprise Identity and on Twitter at @shorinsean.