Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win


Control which DC authenticates a logon request

Posted on 2004-10-21
Medium Priority
Last Modified: 2010-04-19
We have 12 offices connected via a frame relay WAN.  Each office has a local 2k3 DC.   When users log in, I notice that the logon server can be any of the DCs in the WAN.  How can I control which servers authenticate which offices?  Do I have to use sites to do this?  
Question by:shanna1017
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
LVL 21

Expert Comment

ID: 12372756
Using sites will accomplish this.  Make sure that at least one DC in each site is a GC as well.

Author Comment

ID: 12373501
Thanks for the quick response marc.  So without using sites there's no way to do this?  

Also how do I make a server a global catalog server?
LVL 21

Accepted Solution

marc_nivens earned 375 total points
ID: 12373528
Sites are the only way to do this natively.  To make a server a GC, open AD Sites and Services, go under the site in question, and expand the server until you see NTDS Settings.  Right click on NTDS Settings and go to properties, check the Global Catalog box.

Author Comment

ID: 12373649
I'll give that a try.  Thanks!

Expert Comment

ID: 12417323
Also, you need to create site links.  My personal opinion is to create a a site link that connects just two sites.  That way you can assign a cost to the link and control where users will login to if their GC is done.

For example, let's say that I have several offices around the state, one in Portland, one in Salem, one in Eugene, and one in Bend.  The Salem site may have WAN lines connecting it to Bend and Portland, but the bandwidth is better to Portland.  I would create a site link that connects Salem to Portland and assign it a cost of 50 and create a site link that connects Salem and Bend and assign it a cost of 100.  That way your users would always go to Portland for authentication if the Salem GC was down (unless the Portland link was also down)

Also, don't make your infrastructe master the GC.  To view your infrastructure master, open AD Users and Computer and right click the domain container and select Operations Masters.  You will have replication issues if you make the infrastructure master a GC.

Depending on how large your sites are, you can also use the new Universal Group Caching feature.  If your sites are less than 75 users, write back and I'll tell you more about that.

Good luck.


Featured Post


Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I guess it is not common knowledge to most Wintel engineers/administrators: If you have an SNMP-based monitoring system in your environment (and it's common to have SNMP or Syslog) it's reasonably easy to enable monitoring of the Windows Event logs,…
While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
Please read the paragraph below before following the instructions in the video — there are important caveats in the paragraph that I did not mention in the video. If your PaperPort 12 or PaperPort 14 is failing to start, or crashing, or hanging, …
Is your data getting by on basic protection measures? In today’s climate of debilitating malware and ransomware—like WannaCry—that may not be enough. You need to establish more than basics, like a recovery plan that protects both data and endpoints.…
Suggested Courses

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question