Setting up AD global catalog, etc.

wsani
wsani used Ask the Experts™
on
Hi,

I'm working on setting up an whole new AD infrastructure. Here is the breakdown of what I intend to do:

Forest domains:

- corp-dc-[01,02], running Win2k8 R2. These controllers are used for the forest to join the child domains. It will be hosted in a data center in California.

Child domains:

- location1-dc-[01,02], running Wink28 R2. This is going to be child.domain joined to the forest.

- location2-dc-[01,02], running Wink28 R2. This is going to be child.domain joined to the forest.

Location 1 and 2 are offices in California in addition to one more state. While considering the setup above, I need to determine how to setup the Global catalog, Schema master and RID master to make sure that I have a good level of redundancy between all three geo locations.

I want to define the domain controller roles to make sure that each controller has role X and Y, etc.

Any thoughts?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Top Expert 2013

Commented:
the first thought is why do you need three domains?   The forest is the security boundary, and generally you try to start with one domain and if you absolutely need to you add other domains.

FSMO roles can only be held on one DC so you don't really have redundancy with them.  If the DC that holds them goes down hard you can seize those roles. The schema master and Domain naming masters are forest wide roles and the RID, PDCe and Infrastructure master are domain roles.

I'd always try and make every DC a GC.  I also took that lesson from a legend in the AD world...see bullet one  http://adisfun.blogspot.com/2009/04/lessons-learned-from-eric-fleischman.html

Will you be running DNS on your DCs.  If so make them all DNS servers.

If you go with one domain you would create sites for your locations and still have local DCs for them.

Thanks

Mike

Author

Commented:
To answer your question, more DC's because there will be multiple hands administering AD on the global level. I'm going to have two US location in addition to 4 EU locations so, to minimize and separate the location administration, I'm going to use the forest and child domains.

I will be running DNS on DCs. I was planning on running DNS on all of them.
Top Expert 2013

Commented:
Ok then that is an decent design, splitting domains between regions like North America/Europe/Asia is definitely valid.   Not as much for security because the forest is the boundary.

Thanks

Mike
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Author

Commented:
Glad to hear it :) Any other thoughts on what I have?
Top Expert 2013

Commented:
You should be ok with what you have.  

Author

Commented:
Is it possible to have two servers as schema master though?
Top Expert 2013
Commented:
No the schema master (or any FSMO role) can only be held on ond DC at a time

So one schema and domain naming master in the entire forest

..and one RID, PDCemulator, and Infrastructure master in each domain of the forest



Thanks

Mike

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial