AD checks before adding new DC

I am planning on adding a second DNS/DC to my network.  What utilities/checks should I run on my existing server to make sure things are healthy before adding another machine?
smantzDirector of TechnologyAsked:
Who is Participating?
 
ChiefITConnect With a Mentor Commented:
The most important check prior to promoting a server into the domain is a DNS check.

1)You can do this one of two ways. On this new server, you can edit the nic card configuration to have the preferred DNS server AS, the existing DNS server. If you do it this way, I would install DNS on this new machine, and then make it an alternate UNTIL it replicates between the two.  Also, prior to replication, I would recommend making this new server a Global Catalog server..

2) The second method is to install the DNS services prior to promoting the server. If you do so, you will need to make sure it is a fixed IP and then register itself within DNS. Then, you should set the preferred DNS server to be this new machine, with the alternate DNS server as the existing DNS server... After doing so, when promoting, it will ask you if it is the only server on the network. If you say no, it will go out and find the existing server and add the SRV records and the HOST A records within DNS.

The whole idea is to make sure both DCs see each in DNS other prior to DCPROMO... Otherwise, you will have replication problems with the AD objects.

One last thing to consider is native mode versus mixed mode. Can to verify the two operating systems on both DCs with us?? In some cases, you have to prep the domain for new servers, especially if one is an SBS or a 2008 server while the other is a 2003 standard...
0
 
Greg JacknowConnect With a Mentor Commented:
Run DCdiag on your current DC.
 
0
 
smantzDirector of TechnologyAuthor Commented:
I ran straight  DCdiag, without any switches, and all tests passed, anything else?
0
Protect Your Employees from Wi-Fi Threats

As Wi-Fi growth and popularity continues to climb, not everyone understands the risks that come with connecting to public Wi-Fi or even offering Wi-Fi to employees, visitors and guests. Download the resource kit to make sure your safe wherever business takes you!

 
dhruvarajpConnect With a Mentor Commented:
ok.. it is great the the DCDIAG came clean
you might want to run  netdiag /q .. you should not get any output for this command as /q displays only errors

.. once you are done
configure new dc with proper newwork settings and promote the server to become new DC

dns part can be done either before or after dcpromo ..
0
 
Mike KlineCommented:
I also like repadmin  (not needed in your case with only one DC)
CHeck your event logs too.
A decent health checklist is here   http://msmvps.com/blogs/ad/archive/2008/06/03/active-directory-health-checks-for-domain-controllers.aspx
Make the new DC a GC...and try and get it up as soon as you can...gives you redundancy.
Thanks
Mike
0
 
Krzysztof PytkoSenior Active Directory EngineerCommented:
additionally you can also check your DNS condition before setting up new DNS server

use also dcdiag with patameter /test:dns

dcdiag /test:dns
0
 
Greg JacknowCommented:
If those are clean, there is not much else to it.  You can check you event logs to make sure there is nothing alarming.
As for DNS, I prefer to have the new DNS server without DNS and pointing to the existng one for the install, and then add DNS.
Greg J
0
 
smantzDirector of TechnologyAuthor Commented:
Hey,
I ran the netdiag /q and received a failurel for the default gateway test: FATAL  no gateways are reachable.  My NIC is configured properly and I can reach the interenet and I'm using remote desktop with server. I'm sure this is related to my event system error DCOM 10009.  Any ideas?
0
 
ChiefITCommented:
Also, Windows firewall will block AD authentication and netlogon services. Watch out for that, if confiigured on the new DC.
0
 
ChiefITCommented:
I see that you have a multihomed DC. "One nic for the network, and the other as a private link to your firewall." I never recommend multihoming a DC and would suggest you only use one network adapter to communicate with on a DC.
0
 
Mike KlineCommented:
good point about the multihomed DC Chief.

Please look at this great blog entry from Ace  
http://msmvps.com/blogs/acefekay/archive/2009/08/17/multihomed-dcs-with-dns-rras-and-or-pppoe-adapters.aspx

thanks

Mike
0
 
smantzDirector of TechnologyAuthor Commented:
Negative on the multihome.  One NIC, configured with static ip address, DNS pointing to itself,and plugged into a switch that goes to the backbone and private interface of the firewall.  As for my error, I noticed that I have DNS forwarding set to the default gateway.  I'm sure this has to do with my OpenDNS and firewall rules to allow some sites to some and some not to others.  Comments?
0
 
ChiefITCommented:
There is no issue with having your forwarders set to the Gateway IP, IF and only IF your ISP is providing you with a dynamic IP and their DNS servers on the WAN interface of the router. This configuration set up will make your ISP's forwarders dynamic. In other words, if your ISP makes changes to their servers, you automatically get those changes, because they are dynamically passing down to you the ISP's DNS servers.

It's actually a pretty cool trick..
0
 
smantzDirector of TechnologyAuthor Commented:
The dns on the gateway goes to OpenDNS.  That works as it should.  I've since rebooted and I will watch for any other issues like the DCOM 10009 event.  Thanks for all the help.
--Steve
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.