The KCC

When I discussed the Active Directory Replication, I mentioned that AD performs functions such as automatically creating replication links and selecting bridgehead servers. But how does it really do it? The KCC is the one responsible for all these.

The KCC is a built-in service in AD domain controllers and it is responsible for generating and maintaining the replication topology for intra- and inter-site replications. Every 15 minutes, the KCC will revalidate its existing replication topology and make the topology changes if required. It gives enough time for domain controllers to replicate the changes if the existing replication topology is valid.

When it comes to inter-site replication, the KCC selects a single KCC holder in a remote site to act as the Intersite Topology Generator (ISTG), and the ISTG's responsibility is to select the bridgehead servers for replication. The ISTG creates the view of replication topology for all the sites it is connected to. The ISTG is responsible for deciding the topology for the site, and individual domain controllers (such as the KCC) are responsible for making topology decisions locally.

The best way to understand the KCC is to compare it with a network routing protocol. A network routing protocol is responsible for maintaining a routing path for connected networks. If network A needs to communicate with network B, the routing table will tell it what path to go to. In the same way, the topology created by the KCC will tell us how domain controller A can replicate the changes in domain controller B. When I have worked on AD projects, I have seen engineers create manual replication links between domain controllers. But I really doubt whether someone can be smarter than the KCC when it comes to deciding replication topology.