Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Setting W2k3 BDC

Posted on 2009-04-29
17
Medium Priority
?
725 Views
Last Modified: 2012-05-06
I have an existing windows 2003 domain controller, with active directory, dhcp, dns and file server set up on the same box. lets call this 50.0.0.1

But for safety (after very terrible experience) I wanted to set up a Backup Domain Controller (BDC). The process seems easy enough. I setup W2k3, add role as AD and then set the new box as NOT the first DC on the domain. After following through the process I end up with a server that has AD installed, which seems to mimic the PDC. So it seems to serve its purpose.

The problem is that only AD is created on the BDC. It did not create the DHCP and DNS and File Server part.

So the questions are:

1. IF the PDC fails (knock on wood), how would having just a backup AD help, without DHCP and especially without DNS part?
2. It would also help if I get to keep the File Sharing (Security & Privileges) settings.
3. Are there additional steps I need to do on the BDC, in case the PDC fail?
4. How is this better than setting up a backup hard disk so that I can simply replace the damaged PDC? (Although my backups have never succesfully restored a system, I always end up re-installing from scratch manually.... so a hint on this part would also be appreciated).

Thank You
0
Comment
Question by:SW111
  • 5
  • 3
  • 3
  • +3
17 Comments
 
LVL 11

Accepted Solution

by:
willettmeister earned 400 total points
ID: 24262041
If you install the DNS service and make it AD an AD integrated DNS server on the secondary server then DNS will be replicated to the server automatically.  Your IP settings will have to have that servers IP address specified as a secodary DNS server though.  

DHCP is a little more complicated.  The best way to have a backup DHPC server is to install DHCP on the second server and split the scope between the two servers.  The IP address will be retrieved from which ever server answers first.  If possible have more IP address available on both DHCP server than you would use realistically.

0
 
LVL 3

Assisted Solution

by:ISWSIMBX
ISWSIMBX earned 600 total points
ID: 24262054
Do you have a single forest?  I will give my suggestions/answers based on the assumption that you have a single forest.

1.  In Windows 2003, DNS is stored in a application partition if you are using Active Directory Integrated Zones for DNS.  So as long as the 2nd domain controller you are adding is still online, a rebuild of the PDC and replication from the new domain controller will solve your restore concerns.
2. You could leverage DFS for your file shares and that would replicate the data between the two domain controllers and maintain security and permissions.
3. You would need to use NTDSUTIL to seize any FSMO roles that are owned by the PDC.
4. If you lost the PDC, it's rather simple to seize the roles, and your active directory wouldn't be offline for an extended period of time while you restore from disk.
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 24262072
Just to let you know BDC isn't a good label for a secondary Domain Controller because this is what the called it in NT 4.0. Now there isn't any BDCs.

1. If you don't have a secondary DC and your primary DC goes down you will loose all functionality on your Windows Network. When install AD you should always install DNS on the same server.

3. If the primary goes down then clients will start authenticating to the secondary without any Admin interaction. The two things you must be sure to have in place before any failure is that the clients are pointing to the secondary DC for DNS and the secondary is a Global Catalog.

4. If you had a bacup hard disk and then power supply went down how would you install the backup hard disk it wouldn't matter your power supply is down. So, having a second DC you will allow for uptime no matter what happens to the primary.
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
LVL 11

Expert Comment

by:willettmeister
ID: 24262083
I only answered some of the questions.

BDC is a legacy there shoudl be no other steps that you need to do to configure the AD part of the server.  Although you shoudl probably make the server a GC also.

Having mutliple DC's is always a good idea because it can spread the load for authentication as well as provide fault tolerance.  
0
 
LVL 6

Assisted Solution

by:mvgeertruyen
mvgeertruyen earned 200 total points
ID: 24262090
First of all, there is no concept of PDC/BDC since Windows 2000. There is the PDC emulator role for specific things but nothing like in the NT 4 days.

1) If it fails, your second DC will authenticate users. You can install dns on this box as well and integrate it into the active directory so it has an exact copy of the other DC. If your client lease for DHCP is on 3 days then workstations would continue to use their address. Alternativly you can create a backup scope on this DC.

2) This is the case - but shares on the first DC will be unavailable off course.

3) Nope - pretty much automatic for authentication and AD services (remember to put secondary dns servers in DHCP scope and DC's network properties - see 1) )

4) Everything stays online (as above). Restoring a DC requires many more steps...

hope this helps
0
 

Author Comment

by:SW111
ID: 24262142
Thanks for your prompt reply willetmeister.

I've never realized that there's such thing as secondary DNS server. I will look up google on how to do this.

DHCP: Is there a way to simply install the same settings of DHCP (scope and everything else) and leave it OFF until I need to use it? (i.e until PDC fails)? The way I understand it is that DHCP is really only needed when I'm adding a new computer to the network, otherwise every computers will already have been assigned with an IP address, and as long as DNS is alive, they'll be happy.  If this is the case, for my application, I dont really have the need for online redundancy. We can wait a couple of hours for me to set DHCP ON. But is it possible?

Or, on a separate note, since AD is a database, is it possible to simply backup AD and DNS and DHCP info (and file sharing info), and then restore it to a new installation of W2K3?
0
 
LVL 59

Assisted Solution

by:Darius Ghassem
Darius Ghassem earned 400 total points
ID: 24262176
You could use a backup software and restore to another server but you are going to expect longer downtimes this way.

DHCP is used by clients are a regular basis. Clients get a IP address from a DHCP but the IP address is on a lease from the DHCP server not a permanant IP address to the client. Once the lease time is up the client will request another lease from the DHCP server so the DHCP is used a lot.

You can create another DHCP zone on the secondary DC which will not be authorized.
0
 
LVL 3

Expert Comment

by:ISWSIMBX
ID: 24262779
Best thing for AD backups is to use System State Backups.

Here is a good technet article about backing up Active Directory:

http://technet.microsoft.com/en-us/library/cc738755.aspx
0
 
LVL 18

Expert Comment

by:Americom
ID: 24262827
I can't think of any reason why won't you use redundancy DHCP by following the 25/75 rule. Unless you have only one server available to provide DHCP services. Otherwise, why not have two DHCP up running at all the time and not worry about the user not being able to obtain an IP during the few hours outage, afterall, you can't gurantee when a user reboot their machine. Since you will have two DCs, just make them 75% of the IP in one and the other with %25 on the other. Whether these two DCs are on the same subnet or not, you can still leverage the dual DHCP servers for redundancy, afterall, no additional cost.
Other DHCP concern is if you have DHCP Client reservation, you can schedule task to run daily or weekly to export your DHCP database to a file where you can easily import to another DHCP server in just a few minutes when comes to restore. The command to export DHPC database is "netsh dhcp server export C:\dhcpfilename all" and import command is just replace the export with import.

One last thing is you should definitely make both DCs also a GC for what you want to do.
0
 
LVL 11

Expert Comment

by:willettmeister
ID: 24263719
I wouldn't mess with a back up and restore when a secondary server is a much more elegant solution.  Easier to test and easier to maintain.  You can probably run the secondary server on an old desktop if money is an issue.
0
 

Author Comment

by:SW111
ID: 24266310
OK. So here's what I gather:
1. Need to setup Secondary DC (not BDC) with secondary DNS Server
2. dariusg: Need to setup Global Catalog on the Secondary DC and NOT on the PDC (how do I do this?)
3. willettmeister:Have 2 DHCP running all the time. (I thought we cant have 2 DHCP on the same network, otherwise it will mess up the network). I really cant imagine how to split the zones. What is the basis I need to use for the separation? Simply separate any unused IP range into 2 batch?
4. Americon: Given #3, should I still export the DHCP? or will the 2 DHCP somehow take notes of the other's zones? (For example, if I set reservations, do I have to do it on both DHCP? Otherwise, if I reserve 50.0.0.2 on DHCP#1 for Box#1, and it fails, will other clients get this IP instead of Box#1?

On File Server:
5. ISWSIMBX: "You could leverage DFS for your file shares and that would replicate the data between the two domain controllers and maintain security and permissions."--Does this mean somekind of a Secondary File Server? How would I go about setting this up? Right now, I'm using shadow copies. Is thsi what you mean?
6. ISWSIMBX: "You would need to use NTDSUTIL to seize any FSMO roles that are owned by the PDC." I dont understand this part. Do you mean when PDC fails, we need to use NTDSUTIL to switch to Secondary DC? What is FSMO?
0
 

Author Comment

by:SW111
ID: 24266395
I tried setting up the Secondary DNS on the secondary DC, using this guide:
http://support.microsoft.com/kb/816518

But when I am at step#9 on configuring Master DNS IP Address, when clicking Finish I get the following error: "The zone cannot be created. The zone already exists".
I set the zone name to be: location1.mydomain.com (the exact same domain name I set on the PDC).
I set the Master IP to: 50.0.0.1, which is the PDC's IP address.
What went wrong?
0
 

Author Comment

by:SW111
ID: 24266416
Ah, ignore the previous comment. Turns out after doing step#1, Identifying the second DNS, Windows automatically create the forward and reverse zone on the secondary DC. I just had to refresh it since it wasn't showing up before.

I'm now trying to find the global catalog thing because the ms article didnt say anything about GC.
0
 

Author Comment

by:SW111
ID: 24266474
DNS Forwarders.
So I saw on this article: http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/2003_Server/Q_23857184.html 
which links to thi article: http://www.petri.co.il/configure_dns_forwarding.htm 
that I have to set "Forwarding". But on point#2 "Check the Enable forwarders check-box." I cant find a checkbox on the W2K3 I'm using.
The question is, is this step needed?

Global Catalog.
Seems easy enough. I ticked GC on the secondary DC, per this article:
http://support.microsoft.com/kb/313994
So easy, I cant figure out what GC is for. But since It doesnt say secondary GC or backup GC, it just says assign this server (secondary DC) as a GC, will this effect my PDC's GC?
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 24269154
0
 
LVL 18

Assisted Solution

by:Americom
Americom earned 400 total points
ID: 24270228
When you have two DHCP servers, one thing to do is making sure each DHCP scope for the IP ranges are unique without overlaps to avoid duplicate of IPs on your network. For DHCP client reservation, you do not need to created in both DHCP server, just keep it on one only and making sure that one should be backup daily or weekly depending on how frequent you create the reservation. In the event this DHCP server failed and be downed for a few hours, your other DHCP server would be able to lease IP address to the client who reboot their machine during failure of the DHCP server. Usually the client reservation are a smaller portion of your IP scope and having those machine reboot during the duration of the DHCP failure is very unlikely. Of course, it could happen, if your are not sure how long the DHCP server would be offline, you can always use the exported DHCP database and bring it up running on another Windows server with DHCP services installed in just a few minutes by simply importing the DHCP database.
0
 
LVL 3

Assisted Solution

by:ISWSIMBX
ISWSIMBX earned 600 total points
ID: 24272488
Read this to understand FSMO roles:

http://www.petri.co.il/understanding_fsmo_roles_in_ad.htm

You will only need to use NTDSUTIL to seize roles if all of the FSMO roles are on the first domain controller and that domain controller fails.
0

Featured Post

Upgrade your Question Security!

Add Premium security features to your question to ensure its privacy or anonymity. Learn more about your ability to control Question Security today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Want to know how to use Exchange Server Eseutil command? Go through this article as it gives you the know-how.
Transferring FSMO roles is done when an admin wants to split roles between certain Domain Controllers or the Domain Controller holding the Roles has been forcefully demoted using dcpromo / forceremoval
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.
Suggested Courses

810 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question