Active Directory Site/Domain Interactions

I'm having an issue wrapping my head around the myriad Active Directory components, and I'm hoping I can get some opinions or corrections from someone.

At our workplace, we used to have individual active directory domains and sites for each different office location we have. Each location also had a pair of domain controllers that was responsible for that location, and would be used by any stations within that location to manage authentication, GPOs, etc.

Recently, as part of another project, we condensed down all of our domains into our old top level domain. The sites in A/D remained the same, but each individual user account, computer, etc. was moved into the top level domain. Each pair of local DC's was deprecated to just one DC that was a member of the top level domain.

After finishing this, we ran into issues where we were getting -very- slow replication between DCs. The secondary issue of that was individual stations or users seemed to be authenticating against any DC they felt like. On a single station, I found that the user authenticated against one, was receiving DNS from another, and pulling GPOs from somewhere else (I may be mixing this up but you get the idea). It seemed to be essentially random which DC would be contacted by a given station, even though all the DCs were still a member of the proper A/D "sites".

To remedy this problem, we made all the DC's members of the same "top level" site so that replication would essentially be instantaneous. It may sound kind of icky to have that many DCs perpetually replicating to each other, but we run a fairly small setup so there wasn't any major concerns.

My question is, did we go wrong somewhere? I'm currently working on an SCCM install, and only now am I finding out that this is (to put it lightly) not Microsoft's recommended way to do things. My main concerns are:

1) Is this going to bite us later down the road, especially with us being in the midst of trying to set up a stable SCCM install.

2) Can anyone explain why the DC's were getting hit seemingly at random by authentication requests, even though we had them in their corresponding A/D sites (which to the best of my knowledge should give them priority for local requests from stations within the same site).

Thanks!

Answer

There is a bit too much to really handle here in a single question.

First, don't start setting up SCCM without getting AD working correctly. Yes, it will bite you later down the road if you don't fix AD first.

Second, Moving your DC's all to the same site is not a good start. Move the DC's back to their respective sites in AD, make sure your subnets are defined and assigned correctly. If you want to manage replicate, take a look at defining specific site connectors to meet your needs. Take a look at fixing the replication issues before doing something drastic (dcdiag/etc to troubleshoot). Make sure your DNS is clean and working. Take a look at your DHCP settings to make sure the proper DNS servers are getting assigned to the workstations. Make sure your DC's are set with the correct DNS servers.

If you want to go beyond this, find a reputable vendor to work with your to get your environment right.