We will be conducting a DR test and our infrastructure is as follows.
Headquarters has two Domain controllers (same physical location)
HQ1 This is a Global Catlog Srv and holds RID and PDC roles
HQ2 This is not a Global Catalog Srv and holds Schema, Operations Master, Infrastructure
Remote sites (2 different locations)
DR1 This is a Global Catalog Srv and does not hold any FSMO roles
DC1 This is a Global Catalog Srv and does not hold any FSMO roles
We will be conductiong a DR test and we will be disconnecting the HQ fully. My question is what roles will I need in place at the DR1 site to verify that users can log on and function without any connection to HQ1 or HQ2 where the roles current are? Do I need to worry about any conflicts with roles on the DR1 server and what roles do I need to sieze for logon to function.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
As I said: every DC obtains a pool of SIDs (about 500, renewed when the remaining drop below 100) from the RID master.
The remaining DCs *will* be able to create new AD objects as long as their current RID pool isn't exhausted before the RID master comes back online.
How Operations Masters Work
http://technet.microsoft.c
Okay this is great information (http://technet.microsoft.
One last question
What are your recommendations on the five roles? Two are owned by HQ1(RID and PDC) and three are owned by HQ2 (Schema Master, Operations master, Infrastructure. HQ2 is a DNS/File server . Would it make more sense to move those roles (HQ2) to DR site?
Check the223346 article I linked above again:
"FSMO availability and placement
Dcpromo.exe performs the initial placement of roles on domain controllers. This placement is often correct for directories with few domain controllers."
Default in your case would be all roles on one server. AD is designed to be able to keep running for a while even if the FSMO role masters are offline. You usually have enough time to recover from the situation before the need for a FSMO role even arises.
If you put them all on one machine, then you'll have to seize 5 roles if the machine dies unrecoverably.
If you distribute the roles on two machines, you have less roles to seize if a machine dies, but on the other hand, you now have just doubled the chances that a crashed DC will take some FSMOs with it. Just a question of preferences.
Business Accounts
Answer for Membership
by: oBdAPosted on 2009-10-28 at 13:55:47ID: 25688245
You do not need to worry, and you should do *nothing* with the roles!
Users *will* (well, "should") still be able to logon (provided they're using DNS servers that are still active). AD will continue to function, you will even be able to add new users and groups (to a certain extent), because each DC reserves a SID pool from the RID master and can use this pool even while the RID master is offline.
The *only* time when it's necessary to *seize* a role is when a DC dies and can't be recovered. The machine whose role(s) have been seized may NOT come online in the network anymore. *Move* roles if you want to retire a DC.
One note: make HQ2 a GC as well. The rule of not making the IM a GC doesn't apply to a single domain forest.
FSMO placement and optimization on Active Directory domain controllers
http://support.microsoft.c