Free tools Windows power users keep installed
One-click scans. No signup required.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Short answer: In a fully routed Active Directory network, you usually do not need to create a site link bridge because Bridge all site links is enabled by default. Create a manual bridge only when automatic transitivity must be disabled—for example, because firewalls or non-routed network segments restrict which sites may replicate with one another.
When a bridge is necessary, open Active Directory Sites and Services, go to Sites > Inter-Site Transports > IP, right-click IP, and select New Site Link Bridge. Add two or more existing, overlapping site links that represent a real, reachable replication path.
What is an Active Directory site link bridge?
A site link bridge is an Active Directory Domain Services (AD DS) object that groups multiple site links into a transitive replication path. The Knowledge Consistency Checker (KCC) uses that logical relationship when calculating intersite replication topology.
For example:
Site A — Site Link A-B — Site B — Site Link B-C — Site CA bridge containing Site Link A-B and Site Link B-C allows the KCC to treat those links as a connected path between Sites A and C.
#1 Best Overall
A bridge does not create a router, VPN, firewall rule, DNS record, WAN circuit, or domain-controller connection. The underlying network must already permit the replication traffic represented by the bridge. See Microsoft’s AD replication concepts for the distinction between logical topology and physical connectivity.
Do you actually need one?
Use this decision guide before changing the configuration:
| Network or replication condition | Recommended action |
|---|---|
| Fully routed IP network | Leave Bridge all site links enabled. A manual bridge is normally unnecessary. |
| Non-routed or disjoint network segments | Disable automatic bridging and create explicit bridges that match actual reachability. |
| Firewalls block some site-to-site paths | Create bridges only for site links whose traffic can cross the permitted paths. |
| Hub-and-spoke design where satellite-to-satellite replication is undesirable | Consider explicit bridges after designing the desired failover behavior. |
| Replication fails because of DNS, routing, or blocked ports | Fix the network or AD prerequisite. A bridge is not a connectivity repair. |
Microsoft recommends automatic site-link bridging for fully routed networks. Manual bridges are mainly a topology-control mechanism for segmented or partially routed environments. Read Microsoft’s site link bridge design guidance before disabling the default behavior.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Understand the objects involved
- AD site: A logical grouping of IP subnets, normally representing a well-connected network location.
- Site link: A logical WAN connection between one or more sites. Its cost, schedule, and replication interval influence intersite replication.
- Site link bridge: A grouping of multiple site links that permits transitive topology calculations when automatic bridging is disabled or when explicit topology control is required.
- KCC: The AD service that calculates replication connections from sites, links, costs, schedules, and availability.
A site link bridge is not the same thing as a site link. A bridge contains site-link objects; it does not replace them.
Prepare the topology first
Before creating the bridge, document the intended design. For example:
Sites:
Site-A
Site-B
Site-C
Site links:
Site-A-Site-B
Site-B-Site-CConfirm all of the following:
- The sites already exist and their subnets are assigned correctly.
- Every site containing domain controllers belongs to at least one site link.
- The site links use the same transport and form a connected chain.
- Each link overlaps another link through a common site.
- The physical network, routing, DNS, and firewall rules support the intended replication path.
- Unintended duplicate membership has been removed from
DEFAULTIPSITELINKor other links. - You have appropriate administrative permissions, normally Domain Admin or equivalent delegated rights, and are using an elevated management session.
For modern AD DS, use the IP transport. Microsoft does not recommend creating new SMTP site-link objects for current Windows Server deployments. See the site link design documentation.
Check “Bridge all site links”
- Run
dssite.mscto open Active Directory Sites and Services. - Expand Sites.
- Expand Inter-Site Transports.
- Right-click IP and select Properties.
- Review Bridge all site links.
If the option is selected, all IP site links are treated as part of one automatically bridged environment. In a fully routed network, normally leave it selected and do not create a redundant manual bridge.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Disable automatic bridging when required
Only clear this option when your network design requires explicit topology boundaries.
- In Active Directory Sites and Services, open Sites > Inter-Site Transports.
- Right-click IP and select Properties.
- Clear Bridge all site links.
- Click Apply, then OK.
After this change, site links are not automatically treated as transitive. They must be included in explicit site link bridges where transitive connectivity is required.
Create the bridge in the graphical console
- Open Active Directory Sites and Services by running
dssite.msc. - Expand Sites, then Inter-Site Transports.
- Right-click IP.
- Select New Site Link Bridge.
- Enter a descriptive name, such as
HQ-Branch-Replication-Bridge. - Select the site links that belong to the intended path.
- Click Add for each link.
- Confirm that the selected links form a connected chain through overlapping sites.
- Click OK.
For example, a valid bridge could contain:
Bridge: HQ-Branch-Replication-Bridge
Included links:
HQ-to-Regional
Regional-to-BranchDo not add unrelated links such as Link A-B and Link C-D. They have no shared site and do not form a connected topology.
Create the bridge with PowerShell
Use the Active Directory PowerShell module from an appropriately privileged management session:
Recommended Free Tools
New-ADReplicationSiteLinkBridge `
-Name "HQ-Branch-Replication-Bridge" `
-SiteLinksIncluded "HQ-to-Regional","Regional-to-Branch" `
-InterSiteTransportProtocol IPThe -SiteLinksIncluded values must match existing site-link names. Microsoft’s New-ADReplicationSiteLinkBridge documentation provides the current parameter reference.
Verify the result
First confirm that the bridge exists and contains the intended links:
Get-ADReplicationSiteLinkBridge -Filter * |
Format-Table Name,InterSiteTransportProtocol,SiteLinksIncludedReview the underlying site links and their properties:
Get-ADReplicationSiteLink -Filter * |
Format-Table Name,Cost,ReplicationFrequencyInMinutes,SitesIncludedCheck site connectivity information with:
repadmin /showismReview the output for the expected sites, link costs, replication intervals, and connectivity. Microsoft notes that values such as -1:0:0 can indicate that a covered site is not properly connected through the configured topology. Also check the Directory Service event log and replication status on the domain controllers.
The KCC must recalculate topology, and actual replication is governed by site-link schedules and intervals. Do not expect a universal immediate completion time. If you are investigating Event ID 1311, Microsoft advises allowing two times the longest replication interval in the forest after correcting the topology before deciding whether the event continues. See the Event ID 1311 troubleshooting guidance.
How costs and intermediate sites affect replication
The KCC uses site-link cost when calculating replication routes. A path crossing several links generally has a combined cost based on its component links, although schedules, directory partitions, availability, and other topology constraints also matter. Lower-cost paths are generally preferred.
A bridge does not necessarily force every replication operation through the shared intermediate site, nor does it make an intermediate domain controller a mandatory relay. Actual connections depend on the directory partition, available domain controllers, link properties, and the topology calculated by AD DS.
For details about site-link cost, schedules, and intervals, see Microsoft’s site-link properties documentation.
Common mistakes and troubleshooting
Creating a bridge while automatic bridging is enabled
This is often redundant. Check Bridge all site links before creating a manual bridge and document why explicit topology is required.
Selecting non-overlapping links
A bridge must contain a connected set of links. This is valid:
Link A-B
Link B-C
Link C-DThis is not a connected bridge design:
Link A-B
Link C-DAssuming the bridge fixes blocked traffic
If firewalls block the required AD replication ports, or DNS and routing are broken, creating a bridge will not solve the problem. Correct network reachability first, then model that reachability in AD.
Leaving a site out of all site links
A site that is not included in an appropriate site link can become effectively orphaned from the replication topology. Review site and link membership before changing bridges.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Assuming Event ID 1311 proves a bridge is missing
Event ID 1311 can result from automatic bridging across a non-routed network, missing site-link membership, a disconnected topology, replication failures, stale topology, or domain-controller and bridgehead problems. Inspect repadmin /showism, Directory Service events, DNS, firewall rules, and site assignments instead of automatically adding a bridge.
Best Value
Defining preferred bridgehead servers unnecessarily
Do not configure preferred bridgehead servers merely to solve an ordinary topology issue. AD DS normally selects bridgehead servers and handles failover automatically; Microsoft strongly discourages unnecessary preferred bridgehead configuration.
Rollback
If the bridge models the wrong topology:
- Remove the incorrect site link bridge.
- Restore the previous site-link membership if it was changed.
- Re-enable Bridge all site links if that was the previous configuration and the network is fully routed.
- Recheck the topology with
repadmin /showismand review Directory Service events after convergence.
Do not delete the underlying site links as a routine rollback step. Remove them only if the site-link design itself was wrong.
Frequently asked questions
Do I need a site link bridge for three sites?
Not necessarily. If the IP network is fully routed and automatic site-link bridging is enabled, AD DS normally handles transitivity without a manually created bridge.
Can I create a bridge without disabling “Bridge all site links”?
You can create the object, but it is generally redundant while automatic bridging remains enabled. Use explicit bridges when you have intentionally disabled automatic transitivity or need a clearly constrained topology.
How many site links can a bridge contain?
A bridge can contain multiple site links, provided they use the same transport and form a connected, overlapping topology that reflects real network reachability.
Does the intermediate site need a domain controller?
No. The bridge represents a logical transitive path. It does not guarantee that an intermediate domain controller will relay every replication operation.
Should I use an IP or SMTP bridge?
Use the IP transport for modern AD DS. Microsoft does not recommend creating new SMTP site-link objects for current Windows Server environments.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsCan a bridge fix Event ID 1311?
Only if the event is caused by an incorrect site-link topology. Event ID 1311 has multiple possible causes, so verify sites, links, routing, DNS, firewall access, and replication health before changing the bridge configuration.
How long should I wait after creating one?
There is no universal fixed delay. KCC recalculation, site-link schedules, replication intervals, and failures affect convergence. For Event ID 1311 investigations, allow two times the forest’s longest replication interval after the correction before judging whether the event persists.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
