asked on

Two domain controllers - Only one logon server

In our office we currently have two servers running Windows Server 2008 R2 that run as Active Directory Domain Controllers. One is a physical, and one is a Hyper-V virtual server.

I have transferred all the FSMO roles to the physical server, and assumed that server would take care of all the user logons. However it seems that about half get logged in using physical and half get logged in using the virtual.

I'd prefer if users only could log in through the physical machine.
Is this as easy as stopping the NETLOGON service on the virtual server?
Could this have any negative side effects?

Thanks,
Jamie

Elwin3

Moving the FSMO roles does not stop it authenticating logons. Logons are split between all DCs in the local subnet.
If you don't want the virtual server to handle logons then dcpromo it back down to a member server.

jamorlando

ASKER

PS--Sorry for accidentally adding this to the MS Sharepoint Zone. This has nothing to do with Sharepoint.

Could someone kindly answer my question about stopping the NETLOGON service. I know for a fact that would stop it from authenticated user logins. Just don't want to screw anything up by doing this.

Brian Pierce

One of the priciple reasons for having multiple DCs is so that if one fails the other can authenticate users - what you are describing is optimal, not only have you got redunancy but also load balancing- why on earth do you want to change this ?

jamorlando

ASKER

@KCTS: Since the physical domain controller has much better specs than the virtual, I wanted all logins to be handled through that, and then if it failed, it would fail over to the virtual.

I think I see your point though about how this isn't a good idea.

ASKER CERTIFIED SOLUTION

Elwin3

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

jamorlando

ASKER

Thanks, this is the answer I wanted!