Solved

How many DC's needed for my domain.

Posted on 2008-06-13
8
183 Views
Last Modified: 2010-05-18
I've started with a company who has about 60 users, and are setup with two domains in their forrest (Parent and Child).  They run 5 DC's total 2 in the parent and 3 in the child.  I'm hoping to lessen the amount of servers they use here however I'm being told that it is essential to the stability of the network that we reamain using 5 dc's according to my predecessor.   What I believe he may have been reffering to was in regards to the FSMO roles and not having the infastructure master on the same dc as a global catalog server which wouldn't be the case.  Are their any other reasons why this would be?  If more info is needed please let me know.

Thanks,
0
Comment
Question by:rkroger
  • 3
  • 2
8 Comments
 
LVL 58

Expert Comment

by:tigermatt
Comment Utility
If they've got so few users, then there is no gain by separating any resources into their own child domain. I would first start by transitioning from the child domain back to the parent domain, then completely removing the child domain from the network. That will give you 1 single Active Directory domain to play with - much better for a small 60 user environment. I've worked on domains of 2000+ users where they only have one Active Directory domain - the use of subdomains is really only good in very large corporate environments with thousands of users and computers.

In a single-domain environment, you can place all the FSMO roles on the same server as the Global Catalog role. Even in a multiple domain environment, you would only need a second server to move the Infrastructure role to - I guess the third in the parent domain is simply so you can have two Global Catalogs for resilience but still have somewhere to run the Infrastructure Master Operations role from. If you rid yourself of the child domain though, I would say two DCs would probably be enough for that amount of users. 5 DCs in that environment, while it adds lots of resilience, it's probably too much maintenance for you particularly looking at the size of the network. They could easily be put to use as Exchange, SQL servers or file and print servers, without running the DC roles and therefore much more effectively.

I've got clients with 800 user networks who only have 2 - 3 DCs -- it's a good idea for any more than a few users to have more than one DC for resilience, but five for 60 users is overkill.
0
 

Author Comment

by:rkroger
Comment Utility
Thanks for the quick response.

Totally agree with you, I've already made mention that  the current setup is overkill and want to move to a single domain enviroment.  Unfortunately it's not in their plans for this year.  I thought I could lighten my load a bit by reducing it to four servers but they are convinced their is a need for 5.  The only thing I could really find was that you can't have your GC and Infastructure on the same dc.  Also I should mention we use a data center and 2 of the dc's of the child domain sit over here in our office.  Could that have anything to do with needing the 5 dc's?

(Sorry I'm new to multiple domain infastructure)
0
 
LVL 58

Accepted Solution

by:
tigermatt earned 125 total points
Comment Utility
I think there are 5 DCs for the following reasons:

a) You cannot place the Infrastructure Master FSMO operations role on the same server as a Global Catalog server, when there is more than one domain (it's fine in a single-domain environment);
b) It is nice to have resilience.

As a result, the parent domain has 3 DCs - 2 of them probably act as Global Catalog servers, giving resilience. There must therefore be another non-GC DC which is acting as the Infrastructure Master role holder. The child domain then again has 2 DCs for resilience.

I've no idea why they've used a child domain for the office and made it a child of the domain on DCs in the data centre. The correct way to do it would be to just add another site into Active Directory Sites and Services on the parent domain, configure the IP subnet correctly, and then perhaps bring up a DC in the office which is just an additional domain controller for the *parent* domain. There's no need to use a child domain for a branch office - that's just complicating matters beyond what is necessary!

If you still want total resilience and they aren't going to migrate away from the parent/child domain environment, then I think looking at this 5 DCs are going to be required. I guess one of the DCs in the parent domain which is acting as a Global Catalog is unnecessary - but demoting it would only leave one Global Catalog server in that domain.

Once you migrate away from the child domain scenario you should get away with 2 DCs, though. As you can see, this is just one of the many reasons why child domains are not feasible for small businesses and small networks - they just require too many servers to function correctly.

-tigermatt
0
Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 95

Assisted Solution

by:Lee W, MVP
Lee W, MVP earned 125 total points
Comment Utility
Multiple domains makes little sense for most offices.

As for multiple Domain Controllers, I recommend TWO DCs per site.  Any more is excessive.  If the predecessor says you need 5, then ask him WHY?  What's his logic?  Maybe there's something we're not aware of that is unique to your environment.  
0
 

Author Comment

by:rkroger
Comment Utility
Maybe it doesn't matter but it's only 2 dc's in the parent and 3 in the child.  See I thought that if in the child domain i had on dc1 RID and PDC and have it be a Global Catalog.  On dc2 have it be the Infastructure Master and then eliminate the 3rd DC.  I understand some resiliance will be lost but we wouldn't loose functionality on our network.
0
 
LVL 58

Expert Comment

by:tigermatt
Comment Utility
Yes that would certainly work. Don't forget the other roles you need though - they are the PDCe, RID Naming Master, Infrastructure Master, Schema Master and Domain Naming master. It's just the Infrastructure master role which shouldn't be on a GC - other than that it's really up to you. You could in theory have one DC acting as a GC in the child, then have all the FSMO roles on the other DC which isn't a GC. Alternatively, you could have all 4 FSMO roles on the GC DC and just the infrastructure master on the non-GC DC.

Both of these would work.
0

Featured Post

Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

Join & Write a Comment

The 6120xp switches seem to have a bug when you create a fiber port channel when you have a UCS fabric interconnects talking to them.  If you follow the Cisco guide for the UCS, the FC Port channel will never come up and it will say that there are n…
More or less everybody in the IT market understands the basics of Networking, however when we start talking about Storage Networks, things get a bit dizzier, and this is where I would like to help.
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now