Active Directory Replication Load Calculator

connections = N × (N − 1) in a full mesh, 2 × (N − 1) with a hub, 2N in a ring; traffic per day = changes × bytes per change × connections. Active Directory replicates changed attributes rather than whole objects, so the payload is small but the connection count grows quadratically in a full mesh. Convergence is the interval multiplied by the number of hops a change must cross, which is why a ring topology with many DCs converges slowly even though it carries the least traffic.

Replication latency is the window in which a password reset or a disabled account has not reached the DC a user is actually authenticating against, and stale replicas are a routine cause of both lockouts and failed deprovisioning.

This calculator takes 5 inputs: Domain controllers, Directory changes per day, Replicated bytes per change, Replication topology, Replication interval. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Inside a site, DCs use change notification with a 15-second initial delay, so changes propagate within about a minute. Between sites, replication follows the site-link schedule, whose minimum interval is 15 minutes. Urgent events such as account lockouts and password changes are replicated immediately rather than waiting for the schedule.

It converges fastest but its connection count grows as N × (N − 1), so a 30-DC mesh is 870 connections and the traffic and KCC bookkeeping scale with it. Bridgehead-based hub and spoke keeps the connection count linear at the cost of one extra hop of latency.