Implications of seperating DCs and seizing FSMO roles

Posted on 2008-10-28
Last Modified: 2012-05-05
Hi folks,

I would like to know any implications of doing the following, I cannot see any. This is a hypothetical scenario ..

If I had two physical sites, all on the same forest/domain and subnet. There is a DC in both, the DC in site A has all the FSMO roles, and both Site A and Site B DCs are GC servers. There is layer 2 connectivity between these sites, so its all the same broadcast domain and no routing.

What would happen if I broke the link between the sites, and siezed the FSMO roles to the DC in Site B. I'm presuming both sites would continue to operate as normal?

Apart from the obvious like not being able to address computers in the other site, I cannot see any problems with users logging on and authenticating? Should this work?

Question by:ma77smith
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
  • 2
  • +1
LVL 17

Expert Comment

by:Andres Perales
ID: 22825491
You will have issues, when you change schema, or any other information in the domain, because all you primary roles will be at the separate site.
LVL 70

Expert Comment

ID: 22825508
Why Seize the roles - TRANSFER them, its a much cleaner option.

If you split a domain line this then they the DCs will not be able to replicate and if left in this state for more than the tombstone time 60-120 days by defualt depending on the version, you would be unable to connect them again.

Providing that both DCs has a global catalog, DNS and Active Directory then all clients could log on. Eventually though you would hit problems, you would be unable to create new objects on the domain for example if the RID master was not available, you would be unable to make chnages to the infrastructure without the IM Master etc.
LVL 14

Expert Comment

ID: 22825526
You should be able to seize the FSMO roles and continue operating both sites. Basically you would have two seperate but contained domains with the same name and information. As long as you had DNS and AD set up and working at both sites you shouldn't have any "issues".

That beings said I wouldn't recommend doing this.
Free NetCrunch network monitor licenses!

Only on Experts-Exchange: Sign-up for a free-trial and we'll send you your permanent license!

Here is what you get: 30 Nodes | Unlimited Sensors | No Time Restrictions | Absolutely FREE!

Act now. This offer ends July 14, 2017.


Author Comment

ID: 22825715

I cannot transfer as there will be no connectivity between the locations. My point is once I break the site link and seize the FSMO roles I affectively end up with two identical domains, both with GCs and FSMO roles ...

LVL 14

Expert Comment

ID: 22825724
That is correct. I take it they will not be reconnected?

Author Comment

ID: 22825745
No, never reconnected. I know it's not going to be best practice - but I cannot see any foreseeable problems with doing this ..
LVL 70

Accepted Solution

KCTS earned 500 total points
ID: 22825755
OK - I see you want to create two domains from the one
In that case yes - what tou say will work so long as you end up with the FSMO roles on both domains and assuming that you never want to re-connect the two

Author Closing Comment

ID: 31510917
cool, just what I thought - thanks for that

Featured Post

Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article explains the steps required to use the default Photos screensaver to display branding/corporate images
This article shows the method of using the Resultant Set of Policy Tool to locate Group Policy that applies a particular setting.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

691 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question