[Last Call] Learn how to a build a cloud-first strategyRegister Now


domain contorllers

Posted on 2007-08-08
Medium Priority
Last Modified: 2013-11-05
I know you only need 1 DC to run AD, and 2 if you want redundancy, but I thought FSMO roles need to be seperated like schema master, naming master, PDC-RID Infastructor master, and GC should be on seperate boxes, and for growth if you want to expqand the domain or forest later what is the optimal setup to start with, also with W8K server coming I want to be prepared.

Question by:mamidei
LVL 10

Accepted Solution

Darylx earned 375 total points
ID: 19655654
You only need to separate the Global catalog and Infrastructure master roles....  unless all your DCs (could be just the one or lots) are global catalog servers.

Author Comment

ID: 19655744
So on a single domain you really need 2 DC, not one like it has een recommanded?
LVL 30

Expert Comment

ID: 19655807
I recommend a minimum of 2 DCs in any AD environment, no matter how small.  Darylx has already explained the best practices for when you need to separate the Infrastructure Master FSMO from the Global Catalog role.
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

LVL 13

Expert Comment

ID: 19656163
Best practice is to have 2 DC's for redundancy, but this is not a requirement and all FSMO roles can exist on a single DC with a Global Catalog.  In a single domain the infrastructure master and global catalog can reside on the same DC.  This is due to the Infrastructure Master not having "anything to do" (MS parlance).  

Take a look at http://support.microsoft.com/kb/223346.
LVL 70

Expert Comment

ID: 19657223
2 DCs on each site is really recommended to provide within-site redundancy bioth the Global catalog, more can be added for futher load balancing and redundancy. Most people leave the FSMO roles where they are and this works well.

For optimal FSMO placement see http://support.microsoft.com/kb/223346
LVL 10

Expert Comment

ID: 19660584
As everyone else has said, you need two DCs for redundancy.  You can have a domain with just one domain controller but if that server fails, you're screwed.  You couldn't just install a new domain controller to replace the failed server; you'd have to restore it from backup which is a real pain in practice.


Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This process allows computer passwords to be managed and secured without using LAPS. This is an improvement on an existing process, enhanced to store password encrypted, instead of clear-text files within SQL
It’s time for spooky stories and consuming way too much sugar, including the many treats we’ve whipped for you in the world of tech. Check it out!
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

829 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question