Q: What's Active Directory (AD) Link Value Replication (LVR) and how does it benefit AD security?

A: An important deficiency of the way that groups are implemented in Windows 2000 AD is that a group’s membership attribute is completely replicated between DCs every time a group membership change occurs. A change can be as small as a adding or removing a single user to or from the group. This is because group membership is implemented as a normal multi-value AD attribute and multi-value attributes are replicated a single data blob.

Besides transferring more data over the wire than really required, the key problem with this implementation is that when administrators are updating group membership almost simultaneously on different DCs, one of the administrator’s changes will be overwritten by the other administrator’s changes as they're replicated between the two DCs. In Windows 2000 AD, the last writer wins and the first writer’s changes are lost.

Windows Server 2003 AD replication introduces AD LVR, which resolves the above problem. Thanks to LVR, individual values of a multi-value attribute can be replicated separately between AD instances. LVR also reduces AD replication traffic, network bandwidth usage, and processor and memory usage.

LVR is only available if your AD forest doesn't include any Windows 2000 DCs. For Windows Server 2003, this means that your forest must be in the Server 2003 interim or native Server 2003 functionality level. For Windows Server 2008, this means that your forest must be in the Server 2003 or Server 2008 functionality levels.