Application partitions are stored in Active Directory in a similar fashion as a Domain NC. In fact, application partitions and Domain NCs consist of the same two types of objects: a domainDNS object and a crossRef object that resides under the Partitions container in the Configuration naming context (CNC). Application partitions have a similar naming convention as domains and can be named virtually anything you want. You can create an application partition that uses the current namespace within the forest. For example, in the adatum.com (dc=adatum,dc=com) forest, you could create an apps.adatum.com (dc=apps,dc=adatum,dc=com) application partition. Alternatively, a name that is part of a new tree can also be used; for example, apps.local (dc=apps,dc=local). Application partitions can also be subordinate to other application partitions.

Table 17-1 and Table 17-2 contain some of the interesting attributes of domainDNS and crossRef objects as they apply to application partitions.

You want to create or delete an application partition. Application partitions are useful if you need to replicate data to a subset of locations where you have domain controllers. Instead of replicating the application data to all domain controllers in a domain, you can use an application partition to replicate the data to only the domain controllers of your choosing.

To create an application partition, you create a domainDNS object that serves as the root container for the partition. A crossRef object is automatically created in the Partitions container in the Configuration NC. Conversely, when removing an application partition, you only need to remove the crossRef object and the domainDNS is automatically deleted. When you delete an application partition, all objects within the partition also get deleted. Tombstone objects are not created for any of the objects within the application partition or for the application partition itself.

MSDN: Creating an Application Directory Partition; MSDN: Deleting an Application Directory Partition

You want to find the application partitions that have been created in a forest.

To get the list of application partitions in this recipe’s solution, we queried all crossRef objects in the Partitions container that have the systemFlags attribute with the bits 0 and 2 set (5 in decimal). To do this, a logical AND bitwise filter was used. See Searching with a Bitwise Filter for more on searching with a bitwise filter.

You can take a shortcut by not including the bitwise OID in the search filter, and changing it to systemFlags=5. This currently produces the same results in the test forest as with the bitwise filter, but there are no guarantees since it is a bit-flag attribute. You may encounter circumstances in which an application partition would have another bit set in systemFlags that would yield a different value.

In each solution, the dnsRoot attribute was printed for each application partition, which contains the DNS name of the application partition. You can also retrieve the nCName attribute, which contains the distinguished name of the application partition.

Searching with a Bitwise Filter

You want to add or remove a replica server for an application partition. After you’ve created an application partition, you should make at least one other server a replica server in case the first server fails.

When you initially create an application partition, there is only one domain controller that hosts the application partition, namely the one you created the application partition on. You can add any other domain controllers in the forest as replica servers. The list of replica servers is stored in the msDS-NC-Replica-Locations attribute on the crossRef object for the application partition in the Partitions container. That attribute contains the distinguished name of each replica server’s nTDSDSA object. To add a replica server, simply add the DN of the new replica server’s nTDSDSA object. To remove a replica server, remove the DN corresponding to the server’s nTDSDSA object that you want to remove. Behind the scenes, the KCC gets triggered anytime there is a change to that attribute, at which point it will either cause the application partition to get replicated to the target domain controller or remove the replica from the target DC. When a domain controller is demoted, it should automatically remove itself as a replica server for any application partitions that it replicated.

Finding the Replica Servers for an Application Partition for finding the replica servers for an application partition

You want to find the replica servers for an application partition.

The list of replica servers for an application partition is stored in the multivalued msDS-NC-Replica-Locations attribute on the crossRef object for the application partition. This object is located in the Partitions container in the Configuration naming context.

Adding or Removing a Replica Server for an Application Partition for adding and removing replica servers

You want to find the application partitions that a particular server is hosting. Before you decommission a server, it is good to check to see whether it hosts any application partitions and, if so, to add another replica server to replace it.

As described in Adding or Removing a Replica Server for an Application Partition and Finding the Replica Servers for an Application Partition, the msDS-NC-Replica-Locations attribute on crossRef objects contains the list of replica servers for a given application partition. Each of the solutions illustrates how to perform a query using this attribute to locate all of the application partitions a particular domain controller is a replica server for. For the GUI and CLI solutions, you need to know the distinguished name of the nTDSDSA object for the target domain controller.

Adding or Removing a Replica Server for an Application Partition and Finding the Replica Servers for an Application Partition for finding the replica servers for an application partition

You want to verify that an application partition is instantiated on a replica server. After you add a domain controller as a replica server for an application partition, the data in the application partition needs to fully replicate to that domain controller before it can be used on that domain controller.

The dcdiag CheckSDRefDom, VerifyReplicas, and CrossRefValidation tests can help determine whether an application partition has been instantiated on a server and whether there are any problems with it. Here is the dcdiag help information for those three tests:

Another way you can check to see whether a certain application partition has been instantiated on a domain controller is to look at the msDS-HasInstantiatedNCs attribute for the server’s nTDSDSA object. That attribute has DN with Binary syntax and contains a list of all the application partitions that have been successfully instantiated on the server. Unfortunately, tools such as ADSI Edit and DSQuery do not interpret DN with Binary attributes correctly, but it can be viewed with LDP. In addition, you can use AdFind as follows:

adfind -b "cn=NTDS Settings,cn=<DCName>,cn=Servers,cn=<SiteName>,cn=Sites,cn=Configuration,<ForestDN>" -f "msds-HasInstantiatedNCs=B:8:0000000D:<ParitionDN>" -dn

This will return results similar to the following:

AdFind V01.47.00cpp Joe Richards ([email protected]) October 2012

Using server: adatum-dc.adatum.com:389
Directory: Windows Server 2012

dn:cn=NTDS Settings,cn=DC2,cn=Servers,cn=Default-First-Site-Name,cn=Sites
cn=Configuration,dc=adatum,dc=com

1 Objects returned

MSDN: ms-DS-Has-Instantiated-NCs attribute [AD Schema]

You want to set the replication notification delay for an application partition. Two replication-related settings that you can customize for application partitions (or any naming context for which change notification is enabled) include the first and subsequent replication delays after a change to the partition has been detected. The first replication delay is the time that a domain controller waits before it notifies its first replication partner that there has been a change. The subsequent replication delay is the time that the domain controller waits after it has notified its first replication partner before it will notify its next partner. You may need to customize these settings so that replication happens as quickly as you need it to for data in the application partition.

The settings that control the notification delay are stored in the msDS-Replication-Notify-First-DSA-Delay and msDS-Replication-Notify-Subsequent-DSA-Delay attributes on the application partition’s crossRef object in the Partitions container. The time values are stored as seconds. The default for application partitions is 15 seconds for the first delay and three seconds for each subsequent delay.

MSDN: Application Directory Partition Replication [Active Directory]; MSDN: Modifying Application Directory Partition Configuration [Active Directory]; MSDN: ms-DS-Replication-Notify-First-DSA-Delay; MSDN: ms-DS-Replication-Notify-Subsequent-DSA-Delay

You want to set the reference domain for an application partition. Whenever you create an object in Active Directory, the default security descriptor that’s defined in the schema for the object’s class is applied to the object. This default security descriptor may reference specific groups, such as Domain Admins, but it is not specific to a domain. This makes a lot of sense for domain naming contexts, where the Domain Admins group in question would be the one that’s defined in the domain in question. But for application partitions that don’t contain a Domain Admins group, it is not so straightforward. Which domain’s Domain Admins group do you use? To work around this issue, you can set a default security descriptor reference domain for an application partition by setting the msDS-SDReferenceDomain attribute of the partition’s crossRef object. The default value of the msDS-SDReferenceDomain attribute is the domain that the application partition was created in.

If you don’t set the msDS-SDReferenceDomain attribute for an application partition, then a specific hierarchy will be followed to determine the default security descriptor domain. These are the guidelines:

Modifying the Default Security of a Class for more on setting the default security descriptor for a class; Creating and Deleting an Application Partition for creating an application partition

You want to delegate control over the management of an application partition.

If you want to delegate control of management of application partitions, you must grant control over four key attributes. Here is a description of each attribute and what can be accomplished by having control over it:

If you want to delegate control over managing objects within the application partition, you need to follow the same procedures you would when delegating control over objects in a domain naming context. See Delegating Control of an Active Directory Integrated Zone for more information on delegating control.

Delegating Control of an Active Directory Integrated Zone; Using the Delegation of Control Wizard for delegating control; Adding or Removing a Replica Server for an Application Partition for more on adding and removing replica servers; Setting the Replication Notification Delay for an Application Partition for more on the replication delay attributes; Setting the Reference Domain for an Application Partition for more on the default security descriptor domain