Update-UseNotifyReplication.ps1

<#
.SYNOPSIS
    Evaluates and optionally enables the Use_Notify option on AD Site Links.

.DESCRIPTION
    This tool analyzes Active Directory replication topology to identify where the Use_Notify
    feature isn't enabled, and can optionally enable it. Generates an HTML dashboard report.

    Use_Notify enables change notification between domain controllers, reducing replication latency
    from the default 15-minute schedule to near-immediate replication.

    Site Link Options (bit flags per MS-ADTS section 6.1.1.2.2.3.3):
        0x1 (bit 0) - NTDSSITELINK_OPT_USE_NOTIFY: Enables change notification for the site link
        0x2 (bit 1) - NTDSSITELINK_OPT_TWOWAY_SYNC: Enables reciprocal replication (dial-up/VPN scenarios)
        0x4 (bit 2) - NTDSSITELINK_OPT_DISABLE_COMPRESSION: Disables inter-site replication compression
        Bits 3-31 are reserved (must be zero).

    Replication Connection Options (bit flags per MS-ADTS section 6.1.1.2.2.1.2.1.2):
        0x01 (bit 0) - NTDSCONN_OPT_IS_GENERATED: Connection was auto-generated by KCC
        0x02 (bit 1) - NTDSCONN_OPT_TWOWAY_SYNC: Enables reciprocal replication
        0x04 (bit 2) - NTDSCONN_OPT_OVERRIDE_NOTIFY_DEFAULT: Overrides site link notification behavior
        0x08 (bit 3) - NTDSCONN_OPT_USE_NOTIFY: Enables change notification for the connection
        0x10 (bit 4) - NTDSCONN_OPT_DISABLE_INTERSITE_COMPRESSION: Disables compression on this connection
        0x20 (bit 5) - NTDSCONN_OPT_USER_OWNED_SCHEDULE: KCC will not overwrite the schedule on this connection
        0x40 (bit 6) - NTDSCONN_OPT_RODC_TOPOLOGY: Used by FRS replication only; ignored by DRS
        Bits 7-31 are reserved (must be zero).

        KCC propagation: NTDSSITELINK_OPT_USE_NOTIFY (0x1) on a site link causes KCC to set
        NTDSCONN_OPT_OVERRIDE_NOTIFY_DEFAULT | NTDSCONN_OPT_USE_NOTIFY (0x4 | 0x8 = 0xC)
        on auto-generated connections across that link. Setting USE_NOTIFY per-connection
        is unnecessary when site links are configured.

    Partition Notification Delays (crossRef objects in CN=Partitions,CN=Configuration):
        - "msDS-Replication-Notify-First-DSA-Delay": Per-partition override of holdback timer (default: 15s)
        - "msDS-Replication-Notify-Subsequent-DSA-Delay": Per-partition override of inter-DSA delay (default: 3s)
        These AD attributes take precedence over per-DC registry settings. View with: repadmin /notifyopt

    Registry Settings (HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters):
        - "Replicator notify pause after modify (secs)": Holdback timer before notifying partners (default: 15s, was 300s on Win2000)
        - "Replicator notify pause between DSAs (secs)": Delay between partner notifications (default: 3s, was 30s on Win2000)

    Registry Settings (HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters):
        - "AvoidPdcOnWan": When set to 1, DCs won't contact PDC emulator for password changes if in different site

    References:

    MS-ADTS (Active Directory Technical Specification)
        Authoritative source for all bit flag definitions (site link options, connection options, nTDSDSA options).
        This script's constants and binary operations are validated against sections 6.1.1.2.2.3.3 and 6.1.1.2.2.1.2.1.2.
        https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/d2435927-0999-4c62-8c6d-13ba31a52e1a

    Advanced Replication Management (Windows 2000 Resource Kit)
        Original documentation of USE_NOTIFY, TWO_WAY_SYNC, and change notification mechanics.
        Describes the BITWISE-OR procedure for setting site link options and the holdback/inter-DSA timers.
        https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc961787(v=technet.10)

    Active Directory Replication: Change Notification & You (Canberra PFE blog)
        Practical walkthrough of enabling inter-site change notification via ADSI Edit.
        Documents the important caveat that change notification fails with manual connection objects.
        https://learn.microsoft.com/en-us/archive/blogs/canberrapfe/active-directory-replication-change-notification-you

    Understanding Urgent Replication (Ken St. Cyr)
        Explains the distinction between urgent replication, change notification, and immediate replication.
        Clarifies that urgent replication bypasses the notification delay but still requires change notification to be enabled between sites.
        https://learn.microsoft.com/en-us/archive/blogs/kenstcyr/understanding-urgent-replication

    Configuring Change Notification on a Manually Created Replication Partner (Ask DS blog)
        Workaround for manual connections: set NTDSCONN_OPT_USE_NOTIFY (0x8) directly on the connection object.
        Manual connections do not inherit notification settings from site links; this must be done per-connection.
        https://techcommunity.microsoft.com/blog/askds/configuring-change-notification-on-a-manually-created-replication-partner/400188

    Modify the default intra-site DC replication interval (KB214678)
        Documents the per-partition msDS-Replication-Notify-First-DSA-Delay and msDS-Replication-Notify-Subsequent-DSA-Delay attributes.
        These crossRef attributes override per-DC registry timer defaults. This script queries them in the Partition Notification Delays section.
        https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/modify-default-intra-site-dc-replication-interval

.PARAMETER ReportOnly
    Generate a report without making any changes. This is the default behavior.

.PARAMETER EnableSiteLinks
    Enable Use_Notify on site links that don't have it configured.
    KCC-generated connections inherit this setting automatically.
    Manual connections that lack notify are also updated (OVERRIDE_NOTIFY_DEFAULT | USE_NOTIFY).
    This only sets behavior flags; it does not create, delete, or retarget any connection objects.

.PARAMETER GetRegistrySettings
    Query domain controllers for NTDS notification timer registry settings and AvoidPdcOnWan.
    Requires WinRM connectivity to domain controllers.

.PARAMETER ReportPath
    Path to save the HTML report file. Defaults to desktop with timestamp.

.EXAMPLE
    .\Update-UseNotifyReplication.ps1
    Generates an HTML dashboard report of current Use_Notify status.

.EXAMPLE
    .\Update-UseNotifyReplication.ps1 -GetRegistrySettings
    Generates a report including registry notification timer settings from all DCs.

.EXAMPLE
    .\Update-UseNotifyReplication.ps1 -EnableSiteLinks -WhatIf
    Shows what site links would be modified without making changes.

.EXAMPLE
    .\Update-UseNotifyReplication.ps1 -EnableSiteLinks
    Enables Use_Notify on all site links. KCC-generated connections inherit this automatically.

.LINK
    https://github.com/Mike-Crowley/Public-Scripts

.LINK
    https://mikecrowley.us/2026/03/24/instant-active-directory-replication/

.LINK
    https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/d2435927-0999-4c62-8c6d-13ba31a52e1a

.LINK
    https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc961787(v=technet.10)

.LINK
    https://learn.microsoft.com/en-us/archive/blogs/canberrapfe/active-directory-replication-change-notification-you

.LINK
    https://learn.microsoft.com/en-us/archive/blogs/kenstcyr/understanding-urgent-replication

.LINK
    https://techcommunity.microsoft.com/blog/askds/configuring-change-notification-on-a-manually-created-replication-partner/400188

.LINK
    https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/modify-default-intra-site-dc-replication-interval

.NOTES
    Author: Mike Crowley
    https://mikecrowley.us

    Requires: ActiveDirectory module
#>

#Requires -Modules ActiveDirectory

[CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'High', DefaultParameterSetName = 'Report')]
param (
    [Parameter(ParameterSetName = 'Report')]
    [switch]$ReportOnly,

    [Parameter(ParameterSetName = 'Enable')]
    [switch]$EnableSiteLinks,

    [switch]$GetRegistrySettings,

    [ValidateNotNullOrEmpty()]
    [string]$ReportPath = "$([Environment]::GetFolderPath('Desktop'))\$(Get-Date -Format 'yyyyMMdd_HHmmss')_UseNotifyReport.html"
)

# Site Link option flags (MS-ADTS 6.1.1.2.2.3.3)
# Full register:
#   0x1  NTDSSITELINK_OPT_USE_NOTIFY
#   0x2  NTDSSITELINK_OPT_TWOWAY_SYNC
#   0x4  NTDSSITELINK_OPT_DISABLE_COMPRESSION
#   Bits 3-31 reserved.
$SITELINK_USE_NOTIFY = 0x1

# Replication Connection option flags (MS-ADTS 6.1.1.2.2.1.2.1.2)
# Full register:
#   0x01  NTDSCONN_OPT_IS_GENERATED
#   0x02  NTDSCONN_OPT_TWOWAY_SYNC
#   0x04  NTDSCONN_OPT_OVERRIDE_NOTIFY_DEFAULT
#   0x08  NTDSCONN_OPT_USE_NOTIFY
#   0x10  NTDSCONN_OPT_DISABLE_INTERSITE_COMPRESSION
#   0x20  NTDSCONN_OPT_USER_OWNED_SCHEDULE
#   0x40  NTDSCONN_OPT_RODC_TOPOLOGY
#   Bits 7-31 reserved.
$CONN_IS_GENERATED = 0x01
$CONN_OVERRIDE_NOTIFY_DEFAULT = 0x04
$CONN_USE_NOTIFY = 0x08

# Registry default values (Server 2003+ defaults; Win2000 used 300/30)
$DEFAULT_NOTIFY_PAUSE_AFTER_MODIFY = 15  # seconds (holdback timer)
$DEFAULT_NOTIFY_PAUSE_BETWEEN_DSAS = 3   # seconds (delay between notifications)

#region Helper Functions

# Prevent AD object names containing <, >, &, or " from breaking the HTML report.
function ConvertTo-HtmlEncoded {
    param([string]$Text)
    [System.Net.WebUtility]::HtmlEncode($Text)
}

function Get-SiteLinkStatus {
    [CmdletBinding()]
    param()

    Get-ADReplicationSiteLink -Filter * -Properties options, Cost, ReplicationFrequencyInMinutes, SitesIncluded | ForEach-Object {
        $options = if ($null -eq $_.options) { 0 } else { [int]$_.options }
        $siteNames = @($_.SitesIncluded | ForEach-Object { ($_ -split ',')[0] -replace 'CN=', '' })
        [PSCustomObject]@{
            Name                          = $_.Name
            DistinguishedName             = $_.DistinguishedName
            Cost                          = $_.Cost
            ReplicationFrequencyInMinutes = $_.ReplicationFrequencyInMinutes
            SitesIncluded                 = $siteNames -join ', '
            SiteNames                     = $siteNames
            Options                       = $options
            OptionsHex                    = '0x{0:X}' -f $options
            NotifyEnabled                 = ($options -band $SITELINK_USE_NOTIFY) -eq $SITELINK_USE_NOTIFY
        }
    }
}

function Get-ReplicationConnectionStatus {
    [CmdletBinding()]
    param()

    Get-ADReplicationConnection -Filter * -Properties options | ForEach-Object {
        $options = if ($null -eq $_.options) { 0 } else { [int]$_.options }
        $isGenerated    = ($options -band $CONN_IS_GENERATED) -eq $CONN_IS_GENERATED
        $overrideNotify = ($options -band $CONN_OVERRIDE_NOTIFY_DEFAULT) -eq $CONN_OVERRIDE_NOTIFY_DEFAULT
        $notifyEnabled  = ($options -band $CONN_USE_NOTIFY) -eq $CONN_USE_NOTIFY

        # ReplicateFromDirectoryServer = nTDSDSA DN: CN=NTDS Settings,CN=ServerName,CN=Servers,CN=SiteName,...
        # ReplicateToDirectoryServer   = server DN:  CN=ServerName,CN=Servers,CN=SiteName,...
        $fromServer = ($_.ReplicateFromDirectoryServer -split ',')[1] -replace 'CN=', ''
        $toServer   = ($_.ReplicateToDirectoryServer -split ',')[0] -replace 'CN=', ''
        $fromSite   = ($_.ReplicateFromDirectoryServer -split ',')[3] -replace 'CN=', ''
        $toSite     = ($_.DistinguishedName -split ',')[4] -replace 'CN=', ''

        [PSCustomObject]@{
            Name              = $_.Name
            FromServer        = $fromServer
            ToServer          = $toServer
            FromSite          = $fromSite
            ToSite            = $toSite
            IsInterSite       = $fromSite -ne $toSite
            DistinguishedName = $_.DistinguishedName
            Options           = $options
            OptionsHex        = '0x{0:X}' -f $options
            AutoGenerated     = $isGenerated
            OverrideNotify    = $overrideNotify
            NotifyEnabled     = $notifyEnabled
            IsManual          = -not $isGenerated
        }
    }
}

# Fast TCP reachability probe with an explicit timeout. Used to skip unreachable DCs
# before attempting a WinRM/Invoke-Command call, which otherwise blocks for the full
# WSMan connect timeout (can be minutes) when a port is firewalled/dropped.
function Test-TcpPort {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)][string]$ComputerName,
        [int]$Port = 5985,
        [int]$TimeoutMs = 3000
    )

    $client = [System.Net.Sockets.TcpClient]::new()
    try {
        $async = $client.BeginConnect($ComputerName, $Port, $null, $null)
        if ($async.AsyncWaitHandle.WaitOne($TimeoutMs, $false) -and $client.Connected) {
            $client.EndConnect($async)
            return $true
        }
        return $false
    }
    catch {
        return $false
    }
    finally {
        $client.Close()
    }
}

function Get-DCRegistrySettings {
    [CmdletBinding()]
    param()

    # Get-ADDomainController queries the AD topology directly, finding DCs
    # regardless of which OU their computer object resides in.
    $DCs = Get-ADDomainController -Filter *

    foreach ($DC in $DCs) {
        $result = [PSCustomObject]@{
            ComputerName                = $DC.Name
            DNSHostName                 = $DC.HostName
            NotifyPauseAfterModify      = $null
            NotifyPauseAfterModify_Note = $null
            NotifyPauseBetweenDSAs      = $null
            NotifyPauseBetweenDSAs_Note = $null
            AvoidPdcOnWan               = $null
            AvoidPdcOnWan_Note          = $null
            Error                       = $null
        }

        # Fast pre-flight: skip DCs where WinRM (TCP 5985) isn't reachable, so a firewalled
        # or offline DC fails in ~3s instead of blocking on the full WSMan connect timeout.
        # Invoke-Command's default transport is HTTP/5985.
        if (-not (Test-TcpPort -ComputerName $DC.HostName -Port 5985 -TimeoutMs 3000)) {
            $result.Error = 'WinRM (TCP 5985) not reachable within 3s'
            $result
            continue
        }

        try {
            # Short open/operation timeouts so a half-open connection still fails fast.
            $sessionOption = New-PSSessionOption -OpenTimeout 5000 -OperationTimeout 30000

            # Single remote session for both registry hives
            $regData = Invoke-Command -ComputerName $DC.HostName -SessionOption $sessionOption -ScriptBlock {
                @{
                    NTDS     = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters' -ErrorAction SilentlyContinue
                    Netlogon = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters' -ErrorAction SilentlyContinue
                }
            } -ErrorAction Stop

            $ntdsParams = $regData.NTDS
            $netlogonParams = $regData.Netlogon

            # Notification pause after modify (holdback timer)
            $pauseAfterModify = $ntdsParams.'Replicator notify pause after modify (secs)'
            if ($null -eq $pauseAfterModify) {
                $result.NotifyPauseAfterModify = $DEFAULT_NOTIFY_PAUSE_AFTER_MODIFY
                $result.NotifyPauseAfterModify_Note = 'default'
            }
            else {
                $result.NotifyPauseAfterModify = $pauseAfterModify
                $result.NotifyPauseAfterModify_Note = 'custom'
            }

            # Notification pause between DSAs
            $pauseBetweenDSAs = $ntdsParams.'Replicator notify pause between DSAs (secs)'
            if ($null -eq $pauseBetweenDSAs) {
                $result.NotifyPauseBetweenDSAs = $DEFAULT_NOTIFY_PAUSE_BETWEEN_DSAS
                $result.NotifyPauseBetweenDSAs_Note = 'default'
            }
            else {
                $result.NotifyPauseBetweenDSAs = $pauseBetweenDSAs
                $result.NotifyPauseBetweenDSAs_Note = 'custom'
            }

            # AvoidPdcOnWan setting
            $avoidPdc = $netlogonParams.AvoidPdcOnWan
            if ($null -eq $avoidPdc) {
                $result.AvoidPdcOnWan = 0
                $result.AvoidPdcOnWan_Note = 'default'
            }
            elseif ($avoidPdc -eq 1) {
                $result.AvoidPdcOnWan = 1
                $result.AvoidPdcOnWan_Note = 'enabled'
            }
            else {
                $result.AvoidPdcOnWan = $avoidPdc
                $result.AvoidPdcOnWan_Note = 'custom'
            }
        }
        catch {
            $result.Error = $_.Exception.Message
        }

        $result
    }
}

function Get-PartitionNotifySettings {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$ConfigurationDN
    )

    # CrossRef objects live in CN=Partitions under the Configuration partition
    $partitionsDN = "CN=Partitions,$ConfigurationDN"
    $crossRefs = Get-ADObject -SearchBase $partitionsDN -Filter { objectClass -eq 'crossRef' } -Properties 'msDS-Replication-Notify-First-DSA-Delay', 'msDS-Replication-Notify-Subsequent-DSA-Delay', nCName, dnsRoot

    foreach ($ref in $crossRefs) {
        $firstDelay = $ref.'msDS-Replication-Notify-First-DSA-Delay'
        $subDelay = $ref.'msDS-Replication-Notify-Subsequent-DSA-Delay'

        [PSCustomObject]@{
            Partition                    = ($ref.nCName -split ',')[0] -replace 'DC=|CN=', ''
            NCName                       = $ref.nCName
            DnsRoot                      = $ref.dnsRoot
            FirstDSADelay                = $firstDelay
            FirstDSADelay_Note           = if ($null -eq $firstDelay) { 'default (15s)' } else { 'custom' }
            FirstDSADelay_Effective      = if ($null -eq $firstDelay) { $DEFAULT_NOTIFY_PAUSE_AFTER_MODIFY } else { $firstDelay }
            SubsequentDSADelay           = $subDelay
            SubsequentDSADelay_Note      = if ($null -eq $subDelay) { 'default (3s)' } else { 'custom' }
            SubsequentDSADelay_Effective = if ($null -eq $subDelay) { $DEFAULT_NOTIFY_PAUSE_BETWEEN_DSAS } else { $subDelay }
            IsCustom                     = ($null -ne $firstDelay) -or ($null -ne $subDelay)
        }
    }
}

#endregion

#region Main Logic

# Get forest/domain info
$Forest = Get-ADForest
$Domain = Get-ADDomain
$RootDSE = Get-ADRootDSE

Write-Verbose "Retrieving site link information..."
$SiteLinks = @(Get-SiteLinkStatus)

Write-Verbose "Retrieving replication connection information..."
$ReplicationConnections = @(Get-ReplicationConnectionStatus)

# Get AD Sites
$Sites = @(Get-ADReplicationSite -Filter *)

# Partition notification delay settings (always queried; no WinRM required)
Write-Verbose "Retrieving partition notification delay settings..."
$PartitionSettings = @(Get-PartitionNotifySettings -ConfigurationDN $RootDSE.configurationNamingContext)
$PartitionsCustom = @($PartitionSettings | Where-Object { $_.IsCustom })

# Registry settings (optional)
$RegistrySettings = $null
if ($GetRegistrySettings) {
    # Note: queries DCs in the current domain only. In a multi-domain forest,
    # run this from each domain or extend to enumerate all domains via $Forest.Domains.
    Write-Verbose "Retrieving DC registry settings (requires WinRM)..."
    $RegistrySettings = @(Get-DCRegistrySettings)
}

# @() forces arrays so .Count is reliable. In Windows PowerShell 5.1, Where-Object
# returning a single object yields a scalar PSCustomObject whose .Count is $null,
# which would make the health score render blank / 0% when exactly one link matches.
$SiteLinksEnabled = @($SiteLinks | Where-Object { $_.NotifyEnabled })
$SiteLinksDisabled = @($SiteLinks | Where-Object { -not $_.NotifyEnabled })
$ConnectionsManual = @($ReplicationConnections | Where-Object { $_.IsManual })

# Health score based on site links (the efficient place to configure notify)
$healthScore = if ($SiteLinks.Count -gt 0) { [math]::Round(($SiteLinksEnabled.Count / $SiteLinks.Count) * 100) } else { 100 }

#endregion

#region Enable Mode — runs before report generation so the report reflects the final state

if ($EnableSiteLinks) {

    # Create backup before making changes
    $BackupPath = $ReportPath -replace '\.html$', '_Backup.txt'
    $BackupData = @()
    $BackupData += "BACKUP CREATED: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
    $BackupData += "Forest: $($Forest.Name)"
    $BackupData += "Domain: $($Domain.DNSRoot)"
    $BackupData += ""

    if ($SiteLinksDisabled) {
        $BackupData += "SITE LINKS (before changes):"
        $BackupData += ($SiteLinksDisabled | Select-Object Name, DistinguishedName, Options, OptionsHex | Format-List | Out-String)

        foreach ($SiteLink in $SiteLinksDisabled) {
            $newOptions = $SiteLink.Options -bor $SITELINK_USE_NOTIFY
            if ($PSCmdlet.ShouldProcess($SiteLink.Name, "Set options from 0x$($SiteLink.Options.ToString('X')) to 0x$($newOptions.ToString('X'))")) {
                try {
                    Set-ADReplicationSiteLink -Identity $SiteLink.DistinguishedName -Replace @{'options' = $newOptions }
                    Write-Host "  Updated site link: $($SiteLink.Name)" -ForegroundColor Cyan
                }
                catch {
                    Write-Error "Failed to update site link $($SiteLink.Name): $_"
                }
            }
        }
    }
    else {
        Write-Host "  All site links already have Use_Notify enabled." -ForegroundColor Green
    }

    $ManualWithoutNotify = $ConnectionsManual | Where-Object { -not ($_.OverrideNotify -and $_.NotifyEnabled) }

    if ($ManualWithoutNotify) {
        $BackupData += "MANUAL CONNECTIONS (before changes):"
        $BackupData += ($ManualWithoutNotify | Select-Object Name, FromServer, ToServer, ToSite, DistinguishedName, Options, OptionsHex | Format-List | Out-String)

        foreach ($conn in $ManualWithoutNotify) {
            $newOptions = $conn.Options -bor $CONN_OVERRIDE_NOTIFY_DEFAULT -bor $CONN_USE_NOTIFY
            $target = "$($conn.FromServer) -> $($conn.ToServer) [$($conn.ToSite)]"
            if ($PSCmdlet.ShouldProcess($target, "Set connection options from 0x$($conn.Options.ToString('X')) to 0x$($newOptions.ToString('X'))")) {
                try {
                    Set-ADObject -Identity $conn.DistinguishedName -Replace @{ 'options' = $newOptions }
                    Write-Host "  Updated manual connection: $target" -ForegroundColor Cyan
                }
                catch {
                    Write-Error "Failed to update manual connection $($target): $_"
                }
            }
        }
    }
    elseif ($ConnectionsManual.Count -gt 0) {
        Write-Host "  All manual connections already have Use_Notify enabled." -ForegroundColor Green
    }

    # Save backup. Skip under -WhatIf: no changes were made, so there is nothing to back up
    # (and Out-File would otherwise honor $WhatIfPreference and silently write nothing).
    if ($BackupData.Count -gt 4 -and -not $WhatIfPreference) {
        $BackupData | Out-File -FilePath $BackupPath -Encoding UTF8 -Force -WhatIf:$false
        Write-Host "Backup saved to: $BackupPath" -ForegroundColor Yellow
    }

    # Re-query AD so the report reflects the post-change state
    Write-Verbose "Re-querying AD for post-change report..."
    $SiteLinks = @(Get-SiteLinkStatus)
    $ReplicationConnections = @(Get-ReplicationConnectionStatus)
    $SiteLinksEnabled = @($SiteLinks | Where-Object { $_.NotifyEnabled })
    $SiteLinksDisabled = @($SiteLinks | Where-Object { -not $_.NotifyEnabled })
    $ConnectionsManual = @($ReplicationConnections | Where-Object { $_.IsManual })
    $healthScore = if ($SiteLinks.Count -gt 0) { [math]::Round(($SiteLinksEnabled.Count / $SiteLinks.Count) * 100) } else { 100 }
}

#endregion

#region Report Generation

# Compute manual connections needing attention (used in report warnings)
$ManualWithoutNotify = @($ConnectionsManual | Where-Object { -not ($_.OverrideNotify -and $_.NotifyEnabled) })

# Ordered "FromSite|ToSite" pairs spanned by a site link that HAS Use_Notify. Lets the
# connection report tell "site link genuinely lacks notify" apart from "site link has
# notify but KCC hasn't rewritten this inter-site connection yet" (transient convergence lag).
$NotifyEnabledSitePairs = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
foreach ($link in ($SiteLinks | Where-Object { $_.NotifyEnabled })) {
    foreach ($a in $link.SiteNames) {
        foreach ($b in $link.SiteNames) {
            if ($a -ne $b) { [void]$NotifyEnabledSitePairs.Add("$a|$b") }
        }
    }
}

# Build HTML report
$htmlContent = @"
<!-- Report generated $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') by Update-UseNotifyReplication.ps1 -->
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>AD Replication Notify Report - $($Forest.Name)</title>
    <style>
        * { box-sizing: border-box; }
        body {
            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
            margin: 0; padding: 20px;
            background: #1a1a2e; color: #eee;
        }
        .container { max-width: 1400px; margin: 0 auto; }
        h1 { color: #00d4ff; margin-bottom: 5px; }
        h2 { color: #00d4ff; margin-top: 40px; margin-bottom: 15px; border-bottom: 1px solid #2a2a4a; padding-bottom: 10px; }
        .subtitle { color: #888; margin-bottom: 30px; font-size: 14px; }
        .header-info {
            background: #16213e; padding: 15px 20px; border-radius: 8px;
            margin-bottom: 30px; border-left: 4px solid #00d4ff;
        }
        .header-info span { margin-right: 30px; }
        .header-info strong { color: #00d4ff; }
        .metrics {
            display: grid;
            grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
            gap: 15px; margin-bottom: 30px;
        }
        .metric {
            background: #16213e; padding: 20px; border-radius: 8px;
            border-left: 4px solid #00d4ff;
        }
        .metric.good { border-left-color: #4ade80; }
        .metric.warning { border-left-color: #fbbf24; }
        .metric.bad { border-left-color: #f87171; }
        .metric-value { font-size: 32px; font-weight: bold; color: #00d4ff; }
        .metric.good .metric-value { color: #4ade80; }
        .metric.warning .metric-value { color: #fbbf24; }
        .metric.bad .metric-value { color: #f87171; }
        .metric-label { color: #888; font-size: 13px; margin-top: 5px; }
        table { width: 100%; border-collapse: collapse; margin-top: 15px; font-size: 14px; }
        th, td { padding: 12px 10px; text-align: left; border-bottom: 1px solid #2a2a4a; }
        th { background: #16213e; color: #00d4ff; font-weight: 600; position: sticky; top: 0; }
        tr:hover { background: #1f1f3a; }
        .status-good { color: #4ade80; font-weight: 600; }
        .status-bad { color: #f87171; font-weight: 600; }
        .status-info { color: #60a5fa; }
        .status-warn { color: #fbbf24; }
        .tag {
            display: inline-block; padding: 3px 8px; border-radius: 4px;
            font-size: 12px; font-weight: 600;
        }
        .tag-green { background: #166534; color: #4ade80; }
        .tag-red { background: #7f1d1d; color: #fca5a5; }
        .tag-blue { background: #1e3a5f; color: #60a5fa; }
        .tag-yellow { background: #713f12; color: #fbbf24; }
        .tag-gray { background: #374151; color: #9ca3af; }
        .info-box {
            background: #1e3a5f; border-left: 4px solid #60a5fa;
            padding: 15px 20px; border-radius: 0 8px 8px 0; margin: 20px 0;
        }
        .info-box h4 { color: #60a5fa; margin: 0 0 10px 0; }
        .info-box p { margin: 5px 0; color: #cbd5e1; font-size: 14px; }
        .info-box code { background: #0f172a; padding: 2px 6px; border-radius: 3px; font-size: 13px; }
        .recommendation {
            background: #14532d; border-left: 4px solid #4ade80;
            padding: 15px 20px; border-radius: 0 8px 8px 0; margin: 20px 0;
        }
        .recommendation.warning {
            background: #713f12; border-left-color: #fbbf24;
        }
        .recommendation h4 { color: #4ade80; margin: 0 0 10px 0; }
        .recommendation.warning h4 { color: #fbbf24; }
        .recommendation p { margin: 5px 0; color: #cbd5e1; font-size: 14px; }
        .section-desc { color: #888; font-size: 14px; margin-bottom: 15px; }
        .truncate { max-width: 250px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
        .mono { font-family: 'Consolas', 'Monaco', monospace; font-size: 13px; }
        .footer { margin-top: 50px; padding-top: 20px; border-top: 1px solid #2a2a4a; color: #666; font-size: 12px; }
    </style>
</head>
<body>
    <div class="container">
        <h1>AD Replication Notify Report</h1>
        <p class="subtitle">Use_Notify configuration analysis for change notification replication</p>

        <div class="header-info">
            <span><strong>Forest:</strong> $($Forest.Name)</span>
            <span><strong>Domain:</strong> $($Domain.DNSRoot)</span>
            <span><strong>Forest Mode:</strong> $($Forest.ForestMode)</span>
            <span><strong>Generated:</strong> $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')</span>
        </div>

        <div class="metrics">
            <div class="metric $(if ($healthScore -eq 100) { 'good' } elseif ($healthScore -ge 75) { 'warning' } else { 'bad' })">
                <div class="metric-value">$healthScore%</div>
                <div class="metric-label">Health Score</div>
            </div>
            <div class="metric">
                <div class="metric-value">$($Sites.Count)</div>
                <div class="metric-label">AD Sites</div>
            </div>
            <div class="metric $(if ($SiteLinksDisabled.Count -eq 0) { 'good' } else { 'bad' })">
                <div class="metric-value">$($SiteLinksEnabled.Count)/$($SiteLinks.Count)</div>
                <div class="metric-label">Site Links with Notify</div>
            </div>
            <div class="metric">
                <div class="metric-value">$($ReplicationConnections.Count)</div>
                <div class="metric-label">Replication Connections</div>
            </div>
            <div class="metric $(if ($ManualWithoutNotify.Count -eq 0) { 'good' } else { 'warning' })">
                <div class="metric-value">$($ConnectionsManual.Count)</div>
                <div class="metric-label">Manual Connections</div>
            </div>
            <div class="metric $(if ($PartitionsCustom.Count -eq 0) { 'good' } else { 'warning' })">
                <div class="metric-value">$($PartitionsCustom.Count)/$($PartitionSettings.Count)</div>
                <div class="metric-label">Custom Partition Delays</div>
            </div>
$(if ($RegistrySettings) {
    $dcsQueried = @($RegistrySettings | Where-Object { $null -eq $_.Error }).Count
    $dcsWithErrors = @($RegistrySettings | Where-Object { $null -ne $_.Error }).Count
    "            <div class='metric $(if ($dcsWithErrors -eq 0) { 'good' } else { 'warning' })'>" +
    "                <div class='metric-value'>$dcsQueried/$($RegistrySettings.Count)</div>" +
    "                <div class='metric-label'>DCs Registry Queried</div>" +
    "            </div>"
})
        </div>

$(if ($SiteLinksDisabled.Count -gt 0) {
@"
        <div class="recommendation warning">
            <h4>Action Recommended</h4>
            <p><strong>$($SiteLinksDisabled.Count) site link(s)</strong> do not have Use_Notify enabled. Without change notification,
            replication between sites follows the schedule interval (typically 15-180 minutes) rather than occurring immediately after changes.</p>
            <p>Run with <code>-EnableSiteLinks</code> to enable Use_Notify on these site links.
            KCC-generated connections inherit notify behavior from site links automatically.</p>
        </div>
"@
} else {
@"
        <div class="recommendation">
            <h4>All Site Links Configured</h4>
            <p>All site links have Use_Notify enabled. Changes will replicate between sites via change notification rather than waiting for scheduled intervals.</p>
        </div>
"@
})

$(if ($ManualWithoutNotify.Count -gt 0) {
@"
        <div class="recommendation warning">
            <h4>Manual Connections Need Attention</h4>
            <p><strong>$($ManualWithoutNotify.Count) manual connection(s)</strong> do not have Use_Notify enabled. Manual connections do not inherit
            notification settings from site links and require OVERRIDE_NOTIFY_DEFAULT (0x4) | USE_NOTIFY (0x8) set explicitly.</p>
            <p>Run with <code>-EnableSiteLinks</code> to set notify flags on manual connections that lack them.</p>
        </div>
"@
} elseif ($ConnectionsManual.Count -gt 0) {
@"
        <div class="recommendation">
            <h4>Manual Connections Configured</h4>
            <p>$($ConnectionsManual.Count) manual connection(s) exist and all have Use_Notify enabled.</p>
        </div>
"@
})

        <h2>Site Links</h2>
        <p class="section-desc">
            Site links define replication topology between AD sites. When Use_Notify (0x1) is enabled,
            domain controllers send change notifications across the link, enabling near-immediate replication instead of waiting for the scheduled interval.
        </p>

        <table>
            <thead>
                <tr>
                    <th>Name</th>
                    <th>Cost</th>
                    <th>Schedule (min)</th>
                    <th>Sites Included</th>
                    <th>Use_Notify</th>
                    <th>Options</th>
                </tr>
            </thead>
            <tbody>
$(foreach ($link in ($SiteLinks | Sort-Object Name)) {
    $notifyClass = if ($link.NotifyEnabled) { 'tag-green' } else { 'tag-red' }
    $notifyText = if ($link.NotifyEnabled) { 'Enabled' } else { 'Disabled' }
@"
                <tr>
                    <td><strong>$(ConvertTo-HtmlEncoded $link.Name)</strong></td>
                    <td>$($link.Cost)</td>
                    <td>$($link.ReplicationFrequencyInMinutes)</td>
                    <td class="truncate" title="$(ConvertTo-HtmlEncoded $link.SitesIncluded)">$(ConvertTo-HtmlEncoded $link.SitesIncluded)</td>
                    <td><span class="tag $notifyClass">$notifyText</span></td>
                    <td class="mono">$($link.OptionsHex)</td>
                </tr>
"@
})
            </tbody>
        </table>

        <h2>Replication Connections</h2>
        <p class="section-desc">
            Replication connections define the inbound replication path for each domain controller.
            <strong>Auto-generated</strong> connections (created by KCC) inherit Use_Notify from site links.
            <strong>Manual</strong> connections do not inherit from site links and are generally unnecessary.
        </p>

        <div class="info-box">
            <h4>Understanding Connection Types</h4>
            <p><strong>Auto-Generated (KCC):</strong> Created automatically by the Knowledge Consistency Checker. These inherit notification behavior from site links. This is the recommended configuration.</p>
            <p><strong>Manual:</strong> Administrator-created connections. These do not inherit notify from site links and require both OVERRIDE_NOTIFY_DEFAULT (0x4) and USE_NOTIFY (0x8) to be set explicitly. In most environments, these should be removed in favor of KCC-managed connections.</p>
        </div>

        <table>
            <thead>
                <tr>
                    <th>From Server</th>
                    <th>To Server</th>
                    <th>Site(s)</th>
                    <th>Type</th>
                    <th>Notify</th>
                    <th>Options</th>
                </tr>
            </thead>
            <tbody>
$(foreach ($conn in ($ReplicationConnections | Sort-Object ToSite, ToServer)) {
    $typeClass = if ($conn.AutoGenerated) { 'tag-blue' } else { 'tag-yellow' }
    $typeText = if ($conn.AutoGenerated) { 'Auto (KCC)' } else { 'Manual' }

    if ($conn.OverrideNotify -and $conn.NotifyEnabled) {
        # Connection has 0xC set: KCC-inherited from site link or manually configured
        $notifyClass = 'status-good'
        $notifyText = if ($conn.AutoGenerated) { 'Yes (from site link)' } else { 'Yes (explicit)' }
    } elseif (-not $conn.IsInterSite -and $conn.AutoGenerated) {
        # Intra-site KCC connection: change notification is the default behavior within a site.
        # No OVERRIDE/USE_NOTIFY bits needed; the 15s holdback timer applies automatically.
        $notifyClass = 'status-good'
        $notifyText = 'Yes (intra-site default)'
    } elseif ($conn.IsInterSite -and $conn.AutoGenerated) {
        # Inter-site KCC connection missing the USE_NOTIFY bit. Two different causes:
        $notifyClass = 'status-warn'
        if ($NotifyEnabledSitePairs.Contains("$($conn.FromSite)|$($conn.ToSite)")) {
            # Governing site link HAS notify, so KCC simply hasn't rewritten this
            # connection to 0xD yet (replication/KCC lag; typically clears within a cycle).
            $notifyText = 'No (pending KCC update)'
        } else {
            # No notify-enabled site link spans these two sites.
            $notifyText = 'No (site link not configured)'
        }
    } elseif ($conn.IsManual) {
        $notifyClass = 'status-warn'
        $notifyText = 'No (manual connection)'
    } else {
        $notifyClass = 'status-info'
        $notifyText = 'Unknown'
    }

    $siteDisplay = if ($conn.IsInterSite) { "$($conn.FromSite) &rarr; $($conn.ToSite)" } else { $conn.ToSite }
@"
                <tr>
                    <td>$(ConvertTo-HtmlEncoded $conn.FromServer)</td>
                    <td><strong>$(ConvertTo-HtmlEncoded $conn.ToServer)</strong></td>
                    <td>$siteDisplay</td>
                    <td><span class="tag $typeClass">$typeText</span></td>
                    <td class="$notifyClass">$notifyText</td>
                    <td class="mono">$($conn.OptionsHex)</td>
                </tr>
"@
})
            </tbody>
        </table>

        <h2>Partition Notification Delays</h2>
        <p class="section-desc">
            Per-partition notification timing stored on crossRef objects in CN=Partitions,CN=Configuration.
            These AD attributes override the per-DC registry defaults for the specific naming context.
            Queryable via <code>repadmin /notifyopt</code>.
        </p>

        <div class="info-box">
            <h4>Partition vs Registry Settings</h4>
            <p><strong>msDS-Replication-Notify-First-DSA-Delay:</strong> Overrides the holdback timer (registry default: 15s) for this partition. Stored centrally in AD.</p>
            <p><strong>msDS-Replication-Notify-Subsequent-DSA-Delay:</strong> Overrides the inter-DSA delay (registry default: 3s) for this partition. Stored centrally in AD.</p>
            <p>When set, these take precedence over the per-DC registry values for the corresponding naming context.</p>
        </div>

        <table>
            <thead>
                <tr>
                    <th>Partition</th>
                    <th>DNS Root</th>
                    <th>First DSA Delay</th>
                    <th>Subsequent DSA Delay</th>
                </tr>
            </thead>
            <tbody>
$(foreach ($part in ($PartitionSettings | Sort-Object NCName)) {
    $firstClass = if ($part.IsCustom -and $null -ne $part.FirstDSADelay) { 'status-warn' } else { '' }
    $subClass = if ($part.IsCustom -and $null -ne $part.SubsequentDSADelay) { 'status-warn' } else { '' }
@"
                <tr>
                    <td><strong>$(ConvertTo-HtmlEncoded $part.Partition)</strong></td>
                    <td>$(ConvertTo-HtmlEncoded $part.DnsRoot)</td>
                    <td class="$firstClass">$($part.FirstDSADelay_Effective)s <span class="tag tag-gray">$($part.FirstDSADelay_Note)</span></td>
                    <td class="$subClass">$($part.SubsequentDSADelay_Effective)s <span class="tag tag-gray">$($part.SubsequentDSADelay_Note)</span></td>
                </tr>
"@
})
            </tbody>
        </table>

$(if ($PartitionsCustom) {
@"
        <div class="recommendation warning">
            <h4>Custom Partition Delays Detected</h4>
            <p><strong>$($PartitionsCustom.Count) partition(s)</strong> have custom notification delays set via crossRef attributes.
            These override the per-DC registry defaults for those naming contexts.</p>
        </div>
"@
})

$(if ($GetRegistrySettings -and $RegistrySettings) {
    $DCsWithSettings = @($RegistrySettings | Where-Object { $null -eq $_.Error })
    $DCsWithErrors = @($RegistrySettings | Where-Object { $null -ne $_.Error })
@"
        <h2>Domain Controller Registry Settings</h2>
        <p class="section-desc">
            These registry settings control notification timing behavior on each domain controller.
            Values shown are effective settings (custom values or defaults).
        </p>

        <div class="info-box">
            <h4>Registry Settings Reference</h4>
            <p><strong>Notify Pause After Modify (Holdback):</strong> Time to wait after a change before notifying the first partner. Default: 15 seconds (Server 2003+; was 300s on Win2000).
            Prevents excessive notifications during bulk changes.</p>
            <p><strong>Notify Pause Between DSAs:</strong> Delay between notifying each subsequent replication partner. Default: 3 seconds (Server 2003+; was 30s on Win2000).
            Spreads out replication load across partners.</p>
            <p><strong>AvoidPdcOnWan:</strong> When enabled (1), DCs won't urgently replicate password changes to PDC emulator if it's in a different site.
            Useful for branch offices with unreliable WAN links.</p>
        </div>

        <table>
            <thead>
                <tr>
                    <th>Domain Controller</th>
                    <th>Holdback Timer</th>
                    <th>Inter-DSA Delay</th>
                    <th>AvoidPdcOnWan</th>
                </tr>
            </thead>
            <tbody>
$(foreach ($dc in ($DCsWithSettings | Sort-Object ComputerName)) {
    $holdbackClass = if ($dc.NotifyPauseAfterModify_Note -eq 'custom') { 'status-warn' } else { '' }
    $dsaClass = if ($dc.NotifyPauseBetweenDSAs_Note -eq 'custom') { 'status-warn' } else { '' }
    $pdcClass = if ($dc.AvoidPdcOnWan -eq 1) { 'status-warn' } else { '' }
    $pdcText = if ($dc.AvoidPdcOnWan -eq 1) { 'Enabled' } else { 'Disabled' }
@"
                <tr>
                    <td><strong>$(ConvertTo-HtmlEncoded $dc.ComputerName)</strong></td>
                    <td class="$holdbackClass">$($dc.NotifyPauseAfterModify)s <span class="tag tag-gray">$($dc.NotifyPauseAfterModify_Note)</span></td>
                    <td class="$dsaClass">$($dc.NotifyPauseBetweenDSAs)s <span class="tag tag-gray">$($dc.NotifyPauseBetweenDSAs_Note)</span></td>
                    <td class="$pdcClass">$pdcText <span class="tag tag-gray">$($dc.AvoidPdcOnWan_Note)</span></td>
                </tr>
"@
})
$(if ($DCsWithErrors) {
    foreach ($dc in $DCsWithErrors) {
@"
                <tr>
                    <td><strong>$(ConvertTo-HtmlEncoded $dc.ComputerName)</strong></td>
                    <td colspan="3" class="status-bad">Connection Error: $(ConvertTo-HtmlEncoded $dc.Error)</td>
                </tr>
"@
    }
})
            </tbody>
        </table>
"@
})

        <h2>Reference</h2>
        <div class="info-box">
            <h4>Site Link Options (MS-ADTS 6.1.1.2.2.3.3)</h4>
            <p><code>0x1</code> (bit 0) - <strong>NTDSSITELINK_OPT_USE_NOTIFY:</strong> Enables change notification. DCs notify partners of changes rather than waiting for the replication schedule.</p>
            <p><code>0x2</code> (bit 1) - <strong>NTDSSITELINK_OPT_TWOWAY_SYNC:</strong> Enables reciprocal replication. Designed for dial-up/VPN scenarios where only one side can initiate.</p>
            <p><code>0x4</code> (bit 2) - <strong>NTDSSITELINK_OPT_DISABLE_COMPRESSION:</strong> Disables inter-site replication compression on this link.</p>
            <p style="color: #888; margin-top: 5px;">Bits 3-31 are reserved (must be zero).</p>
        </div>
        <div class="info-box">
            <h4>Replication Connection Options (MS-ADTS 6.1.1.2.2.1.2.1.2)</h4>
            <p><code>0x01</code> (bit 0) - <strong>NTDSCONN_OPT_IS_GENERATED:</strong> Auto-generated by KCC. These inherit notification settings from site links.</p>
            <p><code>0x02</code> (bit 1) - <strong>NTDSCONN_OPT_TWOWAY_SYNC:</strong> Reciprocal replication for this connection.</p>
            <p><code>0x04</code> (bit 2) - <strong>NTDSCONN_OPT_OVERRIDE_NOTIFY_DEFAULT:</strong> Required to override the site link's notification behavior on this connection.</p>
            <p><code>0x08</code> (bit 3) - <strong>NTDSCONN_OPT_USE_NOTIFY:</strong> Enables change notification. Only effective when OVERRIDE_NOTIFY_DEFAULT is also set.</p>
            <p><code>0x10</code> (bit 4) - <strong>NTDSCONN_OPT_DISABLE_INTERSITE_COMPRESSION:</strong> Disables compression of replication data on this connection.</p>
            <p><code>0x20</code> (bit 5) - <strong>NTDSCONN_OPT_USER_OWNED_SCHEDULE:</strong> KCC will not overwrite the schedule attribute on this connection.</p>
            <p><code>0x40</code> (bit 6) - <strong>NTDSCONN_OPT_RODC_TOPOLOGY:</strong> Used by FRS replication only; ignored by DRS replication.</p>
            <p style="color: #888; margin-top: 5px;">Bits 7-31 are reserved (must be zero).</p>
            <p style="color: #fbbf24; margin-top: 10px;">KCC propagation: USE_NOTIFY (0x1) on a site link causes KCC to set OVERRIDE_NOTIFY_DEFAULT | USE_NOTIFY (0x4 | 0x8 = 0xC) on auto-generated connections. Configuring site links is the recommended approach.</p>
        </div>

        <div class="footer">
            <p>Generated $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') by <a href="https://github.com/Mike-Crowley/Public-Scripts" style="color: #00d4ff;">Update-UseNotifyReplication.ps1</a> |
            Author: Mike Crowley |
            <a href="https://mikecrowley.us/2026/03/24/instant-active-directory-replication/" style="color: #888;">Blog Post</a> |
            <a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/" style="color: #888;">MS-ADTS</a> |
            <a href="https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc961787(v=technet.10)" style="color: #888;">TechNet Reference</a></p>
        </div>
    </div>

</body>
</html>
"@

# Save HTML report. -WhatIf:$false forces the write even under -EnableSiteLinks -WhatIf:
# generating a report is not a state change, so it must not be suppressed by $WhatIfPreference
# (otherwise Out-File writes nothing and Start-Process then fails on the missing file).
try {
    $htmlContent | Out-File -FilePath $ReportPath -Encoding UTF8 -Force -WhatIf:$false
    Write-Host "Report saved to: $ReportPath" -ForegroundColor Green
    if (Test-Path -LiteralPath $ReportPath) { Start-Process $ReportPath }
}
catch {
    Write-Error "Failed to save report: $_"
}

#endregion