Settings for minimizing periodic WAN traffic (819108)

RESOLUTION

The following sections contain a comprehensive summary of registry settings and Group Policy settings that you can add or modify to minimize WAN traffic. Some of the settings depend on the operating system version that the computer is running.

Part 1: A description of the relevant registry settings

The following registry settings affect WAN traffic and ISDN costs. To minimize periodic WAN traffic and to reduce ISDN costs, configure these settings as appropriate.

The Browser service registry settings

The domain master browser periodicityDescription: The primary domain controller (PDC) is always the domain master browser. Therefore, a master browser on a network that does not host the PDC for the domain activates dial-on-demand links when a server that participates as a master browser tries to locate the PDC. By default, the attempt interval is five minutes. You can create a MasterPeriodicity registry entry that instructs the Browser service to adjust its default interval for contacting a domain master browser. By default, the MasterPeriodicity entry is not present. The recommended default for dial-on-demand deployments is 86,400 seconds (one day).Server list maintenanceDescription: If you enable a server to participate as a browser and to potentially be elected as a master browser for its network, the server will periodically contact the PDC for its domain. By default, the MaintainServerList registry entry is set to Auto. The recommended value is No unless you must have browser functionality on the network. If you must have browser functionality, set this value to Yes. However, make sure to configure the MasterPeriodicity interval to a large enough interval to reduce the number of PDC contacts.

The SAM replication registry settings

Security Accounts Manager (SAM) replication is controlled by the Net Logon service on the PDC. The pulse frequencyDescription: The Pulse entry defines the typical pulse frequency.The maximum pulse frequencyDescription: The PulseMaximum entry defines the maximum pulse frequency.

The dial-up latency registry settings

The expected dial-up delayDescription: The ExpectedDialupDelay entry specifies the time that is required for a dial-up router to dial when it sends a message from a client computer to a domain across a slow link. In this scenario, the domain is trusted by the client computer. Typically, the Net Logon service assumes that it can quickly reach a domain controller. By setting the ExpectedDialupDelay entry, you inform the Net Logon service to expect an additional delay. The recommended value for this setting is the average time in seconds that is required for the dial-on-demand link to be established, plus a constant of 5 seconds for variance.

The Net Logon service registry settings

The AvoidPdcOnWan entryDescription: The AvoidPdcOnWan entry instructs the server that is running the Net Logon service to avoid going to the PDC operations master roles as much as it can. (The operations master roles are also known as flexible single master operations or FSMO.) The AvoidPdcOnWan entry also instructs other components, such as the SAM, that use this information. For example, assume that this entry is enabled on a domain controller in a remote site. In this scenario, the remote domain controller will not try to verify a password with the PDC operations master roles if the client does not authenticate with the local domain controller. In Windows 2000 Service Pack 2 and in later Windows 2000 service packs, in Windows XP, and in Windows Server 2003, the Directory service client queries are issued one time per hour. You can adjust the following registry entries to extend this query time beyond one hour.The negative cache periodDescription: The NegativeCachePeriod entry specifies the time that a client will remember that a domain controller could not be found in a domain. If a program tries again within this time, the client call immediately fails without trying to find a domain controller again. The background retry initial periodDescription: Some programs periodically try to find a domain controller. If the domain controller is not available, these periodic retries can be costly in dial-on-demand scenarios. The BackgroundRetryInitialPeriod entry defines the minimum amount of elapsed time before the first retry occurs. If the value is smaller than the value set in the NegativeCachePeriod entry, the NegativeCachePeriod value is used. The background retry back-off periodDescription: The BackgroundRetryMaximumPeriod entry defines the maximum interval that the retries will be backed off. For example, if the first retry is after 10 minutes, the second retry will be after 20 minutes, and the next retry will be after 30 minutes. This continues until the value in the BackgroundRetryMaximumPeriod entry is reached. Then, the BackgroundRetryBackoffPeriod value is used for the retry interval until the value in the BackgroundRetryQuitTime entry is reached. The background retry quit timeDescription: When a program runs a periodic search for domain controllers and cannot find a domain controller, the value that is set in this entry determines when retries are no longer possible. For more information about these parameters, click the following article number to view the article in the Microsoft Knowledge Base:

DFS registry settings

The frequency of domain controller queries by DFSDescription: The DfsDcNameDelay entry can reduce the frequency of domain controller queries by Distributed File System (DFS). Modify this entry on the client computer. On Window XP-based computers, the default value is set to 60 minutes by using a Group Policy setting. This setting determines how frequently a DFS client discovers the domain controllers.

Windows XP-based client computers dynamically look for updates to the DFS discovery interval. The valid range for DfsDcNameDelay is from 15 minutes to 360 minutes. No restart is required for new settings to take effect.

For more information about the DfsDcNameDelay parameter, click the following article number to view the article in the Microsoft Knowledge Base: The frequency of PDC queries by DFSEvery DFS server that has a domain-based DFS root polls the PDC for changes on the root object. You can control the interval between pollings by setting the SyncIntervalInSeconds registry entry on the DFS root server or servers. By setting this entry, you can control when DFS returns referrals that are based on cached data. If you increase this value, DFS caches namespaces and referrals for a longer duration.The maximum password ageDescription: The MaximumPasswordAge entry defines how long users can log on to the network before they are prompted to change their passwords. For more information about the MaximumPasswordAge entry, click the following article number to view the article in the Microsoft Knowledge Base: Intrasite domain controller replicationDescription: The "Replicator notify pause after modify (secs)" entry defines the delay after a domain controller writes a change to its local copy of the Active Directory directory service and before the domain controller's replication partners are notified of the change. When this interval elapses, the domain controller initiates a notification to each intrasite replication partner that changes exist that must be propagated.The Knowledge Consistency Checker (KCC) replication topology update periodDescription: The "Repl topology update period (secs)" value defines the number of seconds between intervals.

Windows XP Group Policy settings

The following policy settings control the frequency of Net Logon-based traffic and of DFS-based traffic on Windows XP clients. To locate these settings, click Start, click Run, type gpedit.msc, and then click OK.Computer Configuration/Administrative Templates/System/Net Logon

• Scavenge Interval
• Positive Periodic DC Cache Refresh for Non-Background Callers
• Positive Periodic DC Cache Refresh for Background Callers
• Final DC Discovery Retry Settings for Background Callers
• Maximum DC Discovery Retry Interval Settings for Background Callers
• Initial DC Discovery Retry Settings for Background Callers
• Negative DC Discovery Cache Settings
• Contact PDC on logon failure
• Expected dial-up delay on logon

Computer Configuration/Administrative Templates/Network

• Sets how often a DFS Client discovers DCs
  
  By default, a DFS client tries to discover domain controllers every 15 minutes. If you enable the Sets how often a DFS Client discovers DCs setting, you can change the interval. This value is specified in minutes. If you disable this setting or do not configure it, the default value of 15 minutes applies. The corresponding registry subkey is the following:

  HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\System\DFSClient\DfsDcNameDelay

"Group Policy domain controller selection" setting

By default, Group Policy reads and writes changes to the domain controller that is designated as the PDC operations master for the domain. We recommend that you change the Group Policy domain controller selection value on the domain controller that Active Directory Users and Computers or Active Directory Sites and Services uses. The corresponding registry subkey is the following:The DCOption entry stores the setting of the Group Policy domain controller selection Group Policy setting. Group Policy adds the DCOption entry to the registry when you enable the policy. If you disable the policy or set it to "Not configured," Group Policy deletes this entry from the registry, and the computer behaves as if the value is 1.

To change the value of the DCOption entry, configure the Group Policy domain controller selection policy in Group Policy Object Editor. To locate the Group Policy domain controller selection policy, see the following Group Policy object: The following table describes the settings.

Value	Description
1 or not in the registry	Use the PDC. Group Policy reads and writes changes to the domain controller that is designated as the PDC operations master for the domain.
2	Inherit from the Active Directory directory service snap-ins. Group Policy reads and writes changes to the domain controller that Active Directory Users and Computers or Active Directory Sites and Services uses.
3	Use any available domain controller. Group Policy can read and write changes to any available domain controller.

Part 2: Default values

Default values for packet types

The following table shows the packet types and their default send intervals.

Packet type	Protocol	Transport	Interval	Notes
NetLogon	Server message block (SMB)	TCP/IP and NetBIOS Enhanced User Interface (NetBEUI)	300 seconds
Browse	SMB	TCP/IP and NetBEUI	720 seconds	This value applies to Microsoft Windows NT.
KeepAlive	Network basic input/output system (NetBIOS)	TCP/IP	3600 seconds (60 minutes)
SessionAlive	NetBIOS	NetBEUI	30 seconds	This value applies to Microsoft LAN Manager.
KeepAlive	NetBIOS	Internetwork Packet Exchange (IPX)	30 seconds
Echo SMB	SMB	Direct Host IPX	240 seconds
Echo NetBIOS over TCP/IP (NetBT)	NetBIOS	TCP/IP and NetBEUI	120 seconds	If a session is idle, the file server sends an SMB echo frame at the specified interval.
Windows Explorer	SMB	TCP/IP and NetBEUI	32 seconds	This value controls the frequency that the file server sends an SMB echo frame to the client as long as the client has an outstanding long-term request open.
KeepAlive	NetBIOS	TCP/IP	300 seconds (5 minutes)	This entry corresponds to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlServices\NetBT\parameters\SessionKeepAlive
KeepAlive	TCP	TCP/IP	1 second	This entry corresponds to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TCPIP\Parameters\KeepAliveTime

Notes

• The Browse packet type in this table indicates network traffic between a Windows NT-based PDC and its backup domain controllers (BDCs).
• The Windows NT redirector echoes an SMB echo frame every 30 seconds or 32 seconds to each file server that has an associated long-term request that is outstanding. For example, a file server might have a NotifyChange request in Microsoft Internet Explorer. To avoid these packets, you can set the NoRemoteChangeNotify key.
  
  For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

  831129 Folder tree flickers when you view a mapped network drive in Microsoft Windows Explorer

  816375 Windows XP Explorer pane flickers on mapped network drives

• If there is no data transfer between the client and the server for the KeepAlive interval (120 seconds), the server sends the first keep-alive probe. After two minutes of inactivity (idle tree connects), the file server sends a 1-byte session message. The TCP payload is "02". The TCP sequence number starts with the last received acknowledgement (ACK) minus 1 and ends with the current acknowledgement.
• If the connection against the server is made by using named pipes, the server sends an "NetBT: SS - Session Keep Alive" message to the client approximately every 300 seconds.
  
  The NetBT SessionKeepAlive entry is in the following registry subkey:

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters

• A Common Internet File System (CIFS) TCP session keep-alive message includes a byte with an 0x85 value, followed by three bytes with a 0 (zero) value in the NetBT header. The keep-alive message may be sent if no messages have been sent for a client-configurable interval.

The default values for Microsoft Office Outlook 2003 and for Microsoft Exchange Server

By default, the client publishes free or busy information to the server for 15 minutes (900 seconds). In Outlook 2003, the default interval is 45 minutes. To change this interval, follow these steps:

1. Start Microsoft Outlook.
2. On the Tools menu, click Options.
3. On the Preferences tab, click Calendar Options.
4. In the Calendar Options dialog box, click Free/Busy Options.
5. In the Update free/busy information on the server box, type the number of minutes that you want to use as the interval.

The default values for Windows NT 4.0

Component	Default interval setting	Notes
SAM replication	300 seconds (5 minutes)	To change this value, use the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetLogon\Parameters\Pulse Trusts
Relationships	900 seconds (15 minutes)	To change this value, use the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetLogon\Parameters\ScavengeInterval
WINS replication	300 seconds (5 minutes)	To change this value, use the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Replicator\Parameters\Interval, Pulse
License Service Replication	24 hours	By default, the License service replication is performed one time every 24 hours. If, for some reason, the BDC cannot connect to the License Service on the PDC, the BDC continues to try replication one time every 15 minutes until it succeeds. To change this value, use the user interface in Licensing Application, Replication Frequency in Control Panel, or stop the License Logging service (LLS). For more information about how to minimize the traffic over the routers in a Windows NT 4.0 environment, click the following article number to view the article in the Microsoft Knowledge Base: 142692 Minimizing WAN traffic
DFS client	21 minutes	This problem was fixed after Windows NT SP6a was released. To fix this problem, install the hotfix that is described in the following Microsoft Knowledge Base article: 271374 Windows NT 4.0 SP6 clients contact the PDC every 21 minutes You must also disable DFS by setting the following registry subkey to 1: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mup\DisableDFS

Default values for Windows NT 4.0 and Windows 2000

Component	Default interval setting	Notes
Domain browsing	720 seconds (12 minutes)	To change this value, use the following registry subkeys: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\MasterPeriodicity HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\BackupPeriodicity
WINS replication	30 minutes	To change this value, use the WINS graphical user interface (GUI).
Printer browsing	600 seconds (10 minutes)	To disable the browse thread on the current print server, set the following registry subkey to 1: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\DisableServerThread
SMB connections	600 seconds (10 minutes) after close	To change this value, use the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\KeepConn
NetBIOS node type	4 (mixed, or m-node)	To change this value, use the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBt\Parameters\NodeType This registry subkey specifies the mode of NetBIOS name resolution that is used by NetBIOS over TCP/IP, where 1 is b-node, 2 is p-node, 4 is m-node, and 8 is h-node. You can configure this value by using DHCP Manager on the DHCP server. The default is 1 (b-node) if no value is specified. If WINS servers are specified and if the NodeType value is not specified, the default is 8 (h-node).
PPTP "keep-alive" packet	60 seconds	To change this value, use the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Raspptpe\Parameters\Configuration\InactivityIdleSeconds This registry subkey specifies the number of seconds that Point-to-Point Tunneling Protocol (PPTP) will continue without activity on the control channel. By default, PPTP sends a "keep-alive" packet every 60 seconds.

Default values for Windows 2000

Component	Default interval setting	Notes
The Net Logon domain controller discovery	900 seconds (15 minutes)	In Windows 2000 Service Pack 2 (SP2), the Directory service client code was changed so that queries are issued one time per hour. For more information about how to create registry keys to extend this query time beyond one hour, click the following article number to view the article in the Microsoft Knowledge Base: 265395 Windows 2000 member runs discovery every 15 minutes with possible high dial-on-demand line costs
DFS queries for domain controllers	900 seconds (15 minutes)	To change this value, use the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\DfsDcNameDelay For more information, click the following article number to view the article in the Microsoft Knowledge Base: 265395 Windows 2000 member runs discovery every 15 minutes with possible high dial-on-demand line costs
GPO refresh interval	90 minutes	For more information, click the following article number to view the article in the Microsoft Knowledge Base: 265395 Reoccurring WAN traffic every five minutes may cause high line costs
Link Tracking service	4 hours	This interval may cause additional DNS queries. This problem was fixed in Windows 2000 SP2. For more information, click the following article number to view the article in the Microsoft Knowledge Base: 279117 The Distributed Link Tracking Server service may cause additional DNS queries in Windows 2000 Server
MMC, extraneous DNS queries	On action in Group Policy Object Editor	This problem was fixed in Windows 2000 SP3. For more information, click the following article number to view the article in the Microsoft Knowledge Base: 295165 Extraneous DNS queries generate network overhead
DNS service	300 seconds (5 minutes)	This interval may cause high line costs. This problem was fixed in Windows 2000 SP3. For more information, click the following article number to view the article in the Microsoft Knowledge Base: 311736 Reoccurring WAN traffic every five minutes may cause high line costs
The Net Logon service LSA remote procedure call (RPC)	300 seconds (5 minutes)	RPC Active Directory and Exchange replication traffic.
Intrasite domain controller replication	300 seconds (5 minutes)	To change this value, use the following registry subkey: CurrentControlSet\Services\NTDS\Parameters\"Replicator notify pause after modify (secs)" For more information, click the following article number to view the article in the Microsoft Knowledge Base: 214678 How to modify the default intrasite domain controller replication interval

Default values for Windows XP and for Windows Server 2003

Component	Default interval setting	Notes
Time service (W32time)	17 minutes	This value is found in the following registry subkeys: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32time\Config\MaxPollInterval HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32time\Config\MinPollInterval For more information, click the following article number to view the article in the Microsoft Knowledge Base: 823456 Windows Time Service ignores the local polling interval values in Windows Server 2003 and Windows XP If you change the MaxPollInterval and MinPollInterval local polling values for the Microsoft Windows Time service (W32time), the values are ignored. The service always polls at 17-minute intervals.