jcs1977
asked on
highly available domain controllers
I have 1 server that is the main domain controller. I have a 2nd server that I ran dcpromo on to replicate the existing domain controller. I also made this server a global catalog. Now I am reading about FSMO roles and a little unsure on how I can make my domain function if my main server were to go down. I see I can seize them or transfer. How would one seize if the main server was completely down? Can both server have the FSMO roles? If so how is this done?
ASKER
Thanks for the reply.
As for DNS I have a watchguard firewall and in there I have the IP for the domain controller server and a DNS IP gave to me by my IP provider. I havent done anything wiith the DNS on DC 2
I think what I need to configure is Universal Group Membership Caching but still trying to find setting. It is not a big deal if my DC goes down but it is if my users cannot login to their PC's to access the internet. Am I correct?
As for DNS I have a watchguard firewall and in there I have the IP for the domain controller server and a DNS IP gave to me by my IP provider. I havent done anything wiith the DNS on DC 2
I think what I need to configure is Universal Group Membership Caching but still trying to find setting. It is not a big deal if my DC goes down but it is if my users cannot login to their PC's to access the internet. Am I correct?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thank you for your help!! Off to work to go to test logging in when the main global catalog is powered off.
http://support.microsoft.c
Using Ntdsutil.exe to transfer or seize FSMO roles to a domain controller
There are two forest wide FSMO roles (schema and domain naming master) and three domain wide fsmo roles (PDC emulator, RID Master, and Infrastructure Master)
You can split the roles between DCs but you can't have the same FSMO role on two servers simultaneously.
So what happens if your main server went down due to a hardware issue and you are watiing a day or so for a part. In that case you probably don't need to seize the roles right away. Brian Puhl (on the Microsoft AD team) has a really good blog entry on that here
http://blogs.technet.com/b
What to do with FSMO roles
One thing you didn't mention, how is DNS setup on your network?
Thanks
Mike