?
Solved

Active Directory in Windows Server 2008

Posted on 2009-04-16
11
Medium Priority
?
244 Views
Last Modified: 2012-05-06
Resources: 2 x Windows Server 2008 64 bit - Enterprise Edition
DC01 and DC02
Objective: Active Directory Failover or BDC

Hello Experts,

What is the best possible solution for:

Failover Active Directory DC
If one of the DC fails, I would like to have the second DC service the authentication requests.
What are the native options, without using any third party replication software.

Thanks in advance.

RC
0
Comment
Question by:RonCairns
  • 4
  • 3
  • 3
  • +1
11 Comments
 
LVL 21

Assisted Solution

by:snusgubben
snusgubben earned 992 total points
ID: 24159376
Both DCs will handle logon request. There has not been a BDC since NT4 domains.

Just make sure there a a GC avalible.


SG
0
 
LVL 21

Assisted Solution

by:snusgubben
snusgubben earned 992 total points
ID: 24159385
Typo*** Just make sure there is a GC avalible
0
 
LVL 3

Author Comment

by:RonCairns
ID: 24159503
what if one dies will the other DC automatically cater for authentication etc ??
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 3

Author Comment

by:RonCairns
ID: 24159510
Also, should the GC be on both of them ????
0
 
LVL 21

Assisted Solution

by:snusgubben
snusgubben earned 992 total points
ID: 24159556
It's considered as a "best practise" from Microsoft that the DC that holds the Infrastructor Master FSMO role is not a GC, but some MVPs has stated written that that's not the case.

My view of it is that it's better to have 2 GCs even if you only have to DCs, so I would make them both GCs.

If one goes down the other will do all authentication.

You should offcourse make a DR plan if one DC dies. (System state backups,  plan and know how to move the FSMO roles etc).


SG

0
 
LVL 57

Assisted Solution

by:Mike Kline
Mike Kline earned 760 total points
ID: 24159574
Yes if one dies the other will be used for authentication, and yes make them both GC's
Also it would be a good idea for DNS to use active directory integrated DNS.  Your clients would have both DC/DNS servers listed in their DNS settings (for primary and alternate)
No other software is needed, this is where Active Directory shines.
Thanks
Mike
0
 
LVL 57

Assisted Solution

by:Mike Kline
Mike Kline earned 760 total points
ID: 24159612
If all DC's are GCs then the Infrastructure master role doesn't matter. Then it obviously goes on a GC.
In a single domain environment it also doesn't matter.
Thanks
Mike
0
 
LVL 3

Author Comment

by:RonCairns
ID: 24160530
could you plz shed some light on :
how to make both the DCs GC in Windows 2008 environment


Cheers
0
 
LVL 21

Assisted Solution

by:snusgubben
snusgubben earned 992 total points
ID: 24161063
0
 
LVL 7

Assisted Solution

by:kumarnirmal
kumarnirmal earned 248 total points
ID: 24161819
I would like to highlight that a Domain Controller can have both Infrastructure and Global Catalog Role if there is only one Active Directory Domain in the Entire Forest.

Please bear in mind that the Domain Based FSMO Roles such as Infrastructure Master, RID Master and PDC Emulator are always made available so that there is no problem in the domain.

The Forest Based FSMO Roles of Domain Naming Master and Schema Master will be installed on the first Domain Controller promoted in the Domain.
0
 
LVL 57

Accepted Solution

by:
Mike Kline earned 760 total points
ID: 24161851
We are beating this IM/GC question to death :)
MVP Jorge wrote a good short blog entry here
http://blogs.dirteam.com/blogs/jorge/archive/2006/07/18/the-infrastructure-master-fsmo-and-the-gc-role.aspx[i][/i]
No matter what forest structure is, the following rules apply for EACH domain in the forest
(1) If all DCs in a domain are GC, there is no other choice where to put the Infrastructure Master FSMO. So no issue here!


(2) If at least one or more other DCs in a domain (besides the Infrastructure Master FSMO itself) are not a GC, then the Infrastructure Master FSMO should NOT be on a GC. (If the Infrastructure Master FSMO is the ONLY DC within the domain that is not a GC, make it a GC as there is no other DC that is not a GC!)

0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Let's recap what we learned from yesterday's Skyport Systems webinar.
Transferring FSMO roles is done when an admin wants to split roles between certain Domain Controllers or the Domain Controller holding the Roles has been forcefully demoted using dcpromo / forceremoval
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

612 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question