Solved

Configuring New DR DC's

Posted on 2008-06-16
4
253 Views
Last Modified: 2010-03-17
Hi,

we are to configure 2x backup DC's off site @ a DR location over a VPN. What is the best way to do this?

Currently the DC's are all under the same domain, and only domain but i have read that the servers (once configured @ DC's) should be moved in sites and services.  the 2 sites are one sepearte subnets of 172 and 192 ranges.

any tips would be good.
0
Comment
Question by:churchhousetrust
  • 2
4 Comments
 
LVL 8

Accepted Solution

by:
Sinder255248 earned 480 total points
ID: 21792489
If all the DC's are built already, create a new site, and define the subnets against it.  Move the DR DC's into the new site.  When you move the servers give them there new IP Addresses and restart the Netlogon service.  This will force them to re-register their SRV records etc in DNS.
0
 
LVL 1

Author Comment

by:churchhousetrust
ID: 21792500
so change the IP before of after the move?
0
 
LVL 58

Assisted Solution

by:tigermatt
tigermatt earned 20 total points
ID: 21796124
If the DC's are built, then all you have to do is to change the IP address, then move them to the remote location, and then bring them back up on the remote network with the site-to-site VPN present. You will need to ensure you have correctly configured the Sites and Services. You will need to create each subnet in the "Subnets" section of the console, and then create a new site for the DR location. Move the DR's to the correct site by locating them and using the tools in the console to move them.

By placing DCs into the correct site, Active Directory is able to detect which DCs are local and which ones should be used preferentially, before using the ones in a remote location.

--
Below is the procedure for bringing the DCs up as additional domain controllers if you haven't got that far:

Install Windows Server 2003 onto the new server which is intended to be promoted as a Domain Controller. Ensure the new server is assigned a routable static IP address on your IP subnet. Ensure the IP address is not included in any of your existing DHCP scopes. The only DNS server entry at this stage should be the IP address of one of the Domain Controllers which is running the DNS server service on your network.

After installation, join the new machine to the existing domain as a member server. This procedure is exactly the same as joining a workstation to the domain.

The next step is to promote the new server as a Domain Controller for the domain. Enter dcpromo at a command prompt and follow the wizard. When prompted, select the option for an additional domain controller in an existing domain. After the wizard completes, the new server will be acting as a Domain Controller for your domain. It is necessary at this point to restart the server for these changes to be applied.

In a single-domain Active Directory forest, all servers should also be Global Catalog servers. The Global Catalog is a required component of Active Directory which is used during logins to establish universal group membership for a user account. To promote the new server as a Global Catalog, open Active Directory Sites and Services from the Administrative Tools container within Control Panel or on the Start Menu. Double-click Sites, then Servers, followed by the name of the new server. Next, right-click "NTDS Settings" and select Properties. On the General tab, check the Global Catalog checkbox. Restart the new Domain Controller for changes to take effect.

If you wish the new server to become the holder of one or more Operations (FSMO) roles, you will need to transfer these roles to the new server. In a single-domain environment, you gain no benefits from spreading FSMO roles between Domain Controllers

The current FSMO role configuration for your network can be found by running the command "netdom query fsmo" at a command prompt on a Domain Controller.

To transfer one or more of these FSMO roles to the new domain controller, follow the information detailed in the following Microsoft Support article: http://support.microsoft.com/kb/324801. Please ensure any other information you follow is information regarding the TRANSFER of FSMO roles. Seizing FSMO roles is an emergency operation which should not be performed during this procedure.

DNS is a critical component of your Active Directory network. The easiest way to install the DNS role onto the new server is to follow the instructions outlined at http://support.microsoft.com/kb/814591 You should be already using Active Directory-integrated DNS zones, which is the easiest method of allowing DNS replication to occur - DNS information is stored in Active Directory and replicates with Domain Controller replication traffic. To check if your DNS zones are AD-integrated (and convert them if not), please follow http://support.microsoft.com/kb/227844.

You probably want to enable DNS forwarding in the DNS console on the server, too. This forwards lookups for external domains to a DNS server at your ISP, which allows the server to effectively resolve DNS for external domains. More information on forwarders can be found at http://technet2.microsoft.com/WindowsServer/en/Library/ee992253-235e-4fd4-b4da-7e57e70ad3821033.mspx.

To move DHCP to the new server, you will need to first install the role. Please see http://support.microsoft.com/kb/300429 for information on how to do this. To correctly configure DHCP after the role is installed on your new server, you will need to ensure you configure it to distribute IP addresses which are in a different range to the IP scope defined on the other DHCP servers. You should also ensure the correct DNS and WINS servers are entered into the scope options. Remember that the only DNS servers which should be configured on workstations are the Domain Controllers which are also acting as DNS servers - no ISP DNS server should ever be set through DHCP.

--

-tigermatt
0
 
LVL 8

Assisted Solution

by:Sinder255248
Sinder255248 earned 480 total points
ID: 21801333
I'd change it after, if you change it before it's going to fall off the network anyway as the network addressing scheme will probably change.
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Join & Write a Comment

The saying goes a bad carpenter blames his tools. In the Directory Services world a bad system administrator, well, even with the best tools they’re probably not going to become an all star.  However for the system admin who is willing to spend a li…
Starting in Windows Server 2008, Microsoft introduced the Group Policy Central Store. This automatically replicating location allows IT administrators to have the latest and greatest Group Policy (GP) configuration settings available. Let’s expl…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now