{"id":18952413,"url":"https://github.com/tailscale/active-directory-sites-subnets","last_synced_at":"2026-05-05T03:39:17.788Z","repository":{"id":146333711,"uuid":"533083897","full_name":"tailscale/active-directory-sites-subnets","owner":"tailscale","description":"Populate Active Directory Sites \u0026 Subnets table for Tailscale clients","archived":false,"fork":false,"pushed_at":"2023-12-18T22:38:44.000Z","size":30,"stargazers_count":1,"open_issues_count":2,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-02-16T11:08:45.286Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tailscale.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-09-05T22:52:40.000Z","updated_at":"2024-01-31T16:40:20.000Z","dependencies_parsed_at":"2023-06-14T05:45:22.413Z","dependency_job_id":null,"html_url":"https://github.com/tailscale/active-directory-sites-subnets","commit_stats":null,"previous_names":["tailscale/active-directory-sites-subnets"],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tailscale%2Factive-directory-sites-subnets","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tailscale%2Factive-directory-sites-subnets/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tailscale%2Factive-directory-sites-subnets/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tailscale%2Factive-directory-sites-subnets/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tailscale","download_url":"https://codeload.github.com/tailscale/active-directory-sites-subnets/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239951656,"owners_count":19723915,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-08T13:33:16.613Z","updated_at":"2026-03-29T03:30:19.008Z","avatar_url":"https://github.com/tailscale.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"## Tailscale \u0026 the Domain Controller Locator Process\n\n### Problem Statement\nLarge Windows environments often have multiple Domain Controllers in different\nregions of the planet. Client Windows systems use the DC Locator Process to find\nthe nearest Domain Controller.\n\nThe subnet-to-site mapping in Active Directory would, in a traditional network,\nconsist mostly of CIDR ranges:\n\n| Name | Site | Location | Type | Description\n|------|------|----------|------|------------\n|192.168.1.0/16|LHR-DC|London|Subnet|\n|192.168.2.0/16|ATL-DC|Atlanta|Subnet|\n|192.168.3.0/16|TOK-DC|Tokyo|Subnet|\n\nThis works for corporate buildings and for traditional concentrator-based\nVPNs, where all VPN clients should use the Domain Controller closest to the\nconcentrator. It does not work well for a Mesh VPN.\n\n### Overview of this tool\nThis is a CLI tool to run on a Tailscale-connected client which can see all\nof the other connected clients. If ACLs block visibility between most Users,\nit will need to run on an administrative node which does have visibility to\nthe other devices.\n\nThe CLI tool takes a set of command-line arguments to map Tailscale\n[DERP Relay locations](https://tailscale.com/blog/how-tailscale-works/#encrypted-tcp-relays-derp)\nto the nearest Active Director Comain Controller. For example in a\nset of Domain Controllers in Atlanta, London, and Tokyo, one might use:\n```\nts-AD-sites.exe --map=\"nyc:ATL-DC\" --map=\"ord:ATL-DC\" --map=\"dfw:ATL-DC\" \\\n    --map=\"sin:TOK-DC\" --map=\"syd:TOK-DC\" --map=\"tok:TOK-DC\" \\\n    -–map-default=\"LHR-DC\"\n```\n\niIt will then output a series of PowerShell commands to populate the Active\nDirectory `Sites` \u003e `Subnets` table:\n```\nGet-ADReplicationSubnet -Filter \"Location -like '*Tailscale'\" | Remove-ADReplicationSubnet\nNew-ADReplicationSubnet -Name '100.100.101.101/32' -Location 'Tailscale' -Site TOK-DC\nNew-ADReplicationSubnet -Name 'fd7a:115c:a1e0:ab12:4843:cd96:6264:6565/128' -Location 'Tailscale' -Site TOK-DC\nNew-ADReplicationSubnet -Name '100.100.101.102/32' -Location 'Tailscale' -Site ATL-DC\nNew-ADReplicationSubnet -Name 'fd7a:115c:a1e0:ab12:4843:cd96:6264:6566/128' -Location 'Tailscale' -Site ATL-DC\nNew-ADReplicationSubnet -Name '100.100.101.103/32' -Location 'Tailscale' -Site TOK-DC\nNew-ADReplicationSubnet -Name 'fd7a:115c:a1e0:ab12:4843:cd96:6264:6567/128' -Location 'Tailscale' -Site TOK-DC\nNew-ADReplicationSubnet -Name '100.100.101.104/32' -Location 'Tailscale' -Site LHR-DC\nNew-ADReplicationSubnet -Name 'fd7a:115c:a1e0:ab12:4843:cd96:6264:6568/128' -Location 'Tailscale' -Site LHR-DC\n```\n\nNote that the tool makes no immediate changes in the configuration of Active Directory,\nand indeed has no permissions to do so. It just outputs PowerShell commands to be\nexamined and run by a Domain Admin.\n\n| Name | Site | Location | Type | Description\n|------|------|----------|------|------------\n|100.100.101.101/32|TOK-DC|Tailscale|Subnet|\n|fd7a:115c:a1e0:ab12:4843:cd96:6264:6565/128|TOK-DC|Tailscale|Subnet|\n|100.100.101.102/32|ATL-DC|Tailscale|Subnet|\n|fd7a:115c:a1e0:ab12:4843:cd96:6264:6566/128|ATL-DC|Tailscale|Subnet|\n|100.100.101.103/32|TOK-DC|Tailscale|Subnet|\n|fd7a:115c:a1e0:ab12:4843:cd96:6264:6567/128|TOK-DC|Tailscale|Subnet|\n|100.100.101.104/32|LHR-DC|Tailscale|Subnet|\n|fd7a:115c:a1e0:ab12:4843:cd96:6264:6568/128|LHR-DC|Tailscale|Subnet|\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftailscale%2Factive-directory-sites-subnets","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftailscale%2Factive-directory-sites-subnets","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftailscale%2Factive-directory-sites-subnets/lists"}