Implications of seperating DCs and seizing FSMO roles

Posted on 2008-10-28
Last Modified: 2012-05-05
Hi folks,

I would like to know any implications of doing the following, I cannot see any. This is a hypothetical scenario ..

If I had two physical sites, all on the same forest/domain and subnet. There is a DC in both, the DC in site A has all the FSMO roles, and both Site A and Site B DCs are GC servers. There is layer 2 connectivity between these sites, so its all the same broadcast domain and no routing.

What would happen if I broke the link between the sites, and siezed the FSMO roles to the DC in Site B. I'm presuming both sites would continue to operate as normal?

Apart from the obvious like not being able to address computers in the other site, I cannot see any problems with users logging on and authenticating? Should this work?

Question by:ma77smith
  • 3
  • 2
  • 2
  • +1
LVL 17

Expert Comment

by:Andres Perales
ID: 22825491
You will have issues, when you change schema, or any other information in the domain, because all you primary roles will be at the separate site.
LVL 70

Expert Comment

ID: 22825508
Why Seize the roles - TRANSFER them, its a much cleaner option.

If you split a domain line this then they the DCs will not be able to replicate and if left in this state for more than the tombstone time 60-120 days by defualt depending on the version, you would be unable to connect them again.

Providing that both DCs has a global catalog, DNS and Active Directory then all clients could log on. Eventually though you would hit problems, you would be unable to create new objects on the domain for example if the RID master was not available, you would be unable to make chnages to the infrastructure without the IM Master etc.
LVL 14

Expert Comment

ID: 22825526
You should be able to seize the FSMO roles and continue operating both sites. Basically you would have two seperate but contained domains with the same name and information. As long as you had DNS and AD set up and working at both sites you shouldn't have any "issues".

That beings said I wouldn't recommend doing this.
Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.


Author Comment

ID: 22825715

I cannot transfer as there will be no connectivity between the locations. My point is once I break the site link and seize the FSMO roles I affectively end up with two identical domains, both with GCs and FSMO roles ...

LVL 14

Expert Comment

ID: 22825724
That is correct. I take it they will not be reconnected?

Author Comment

ID: 22825745
No, never reconnected. I know it's not going to be best practice - but I cannot see any foreseeable problems with doing this ..
LVL 70

Accepted Solution

KCTS earned 500 total points
ID: 22825755
OK - I see you want to create two domains from the one
In that case yes - what tou say will work so long as you end up with the FSMO roles on both domains and assuming that you never want to re-connect the two

Author Closing Comment

ID: 31510917
cool, just what I thought - thanks for that

Featured Post

Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
JRNL_WRAP_ERROR issue in sysvol 20 28
WriteBack Attribute permission on domain level 13 62
MS Endpoint Protection 2 21
This script can help you clean up your user profile database by comparing profiles to Active Directory users in a particular OU, and removing the profiles that don't match.
This article runs through the process of deploying a single EXE application selectively to a group of user.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

786 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question