Active Directory Cookbook

11.6. Finding Missing Subnets

Problem

You want to find the subnets that are missing from your site topology. Missing subnets can result in clients not authenticating against the most optimal domain controller, which can degrade performance.

Solution

Having all of your subnets in Active Directory is important because a client that attempts to logon from a subnet that is not associated with any site may authenticate with any domain controller in the domain. This can result in the logon process taking longer to complete. Unfortunately, Microsoft has not provided an easy way to rectify this problem.

Under Windows 2000, the only source of missing subnet information was the System event 5778. Here is an example:

Event Type:        Information
Event Source:        NETLOGON
Event Category:        None
Event ID:        5778
Date:                1/27/2003
Time:                12:07:04 AM
User:                N/A
Computer:        DC2
Description:
'JSMITH-W2K' tried to determine its site by looking up its IP address ('10.21.85.34') 
in the Configuration\Sites\Subnets container in the DS.  No subnet matched the IP 
address.  Consider adding a subnet object for this IP address.

The only way to dynamically determine missing subnets is to query each domain controller for 5778 events and map the IP addresses specified within the events to a subnet you add to the site topology.

With Windows Server 2003 things are not that much better. One of the issues with the 5778 events under Windows 2000 is that they could easily fill up your System event log if you had many missing subnets. In Windows ...