• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 635
  • Last Modified:

Second AD Domain Controller

I have a server which runs 4 virtual machines on Hyper-V, and is also a DC, DNS, DHCP. I want to obvously have a backup of this. I have two older machines which I premarily use as SQL batch operation machines.

Should I install promote a virtual machine, or one of the old physical machines? what happens when the old physical machine dies? Does that leave rouge crap in AD forever that is always causing errors? I have had this problem before on another network where one of the DCs died, and I could never get rid of some phantom issues where it was looking for the other machine first.

the only reason I could think to use a virtual machine as the secondary DC would be because I can redeploy that from backup image, and bam I have my AD back. the physical old machine I think would be the best route, but if it dies, I dont want to replace right away likely. So what happens when a secondary DC just drops off the face of the earth I guess is the real question?
0
markterry
Asked:
markterry
  • 4
  • 3
  • 2
2 Solutions
 
MattrwCommented:
Virtual DC's can be a bit of a problem.  If the virtual DC has a problem with it's network connectivity it will opt to receive it's time source from the the clock on the hardware it's hosted.  This in turn can cause problems because it may fall out of sync with other DC's while it thinks it has the correct time.  MS recommend you stick with physical DC's where ever possible.  If your physical DC is lost foreever then seize the roles this broken DC held, rebuild  a new  server promote it and name it accordingly it will start to replicate all of the information from the other domain controllers.
0
 
MattrwCommented:
Further Clarification:  Your DC's should have an NTP time source set such as an atomic clock which can be updated over the internet.  If your virtual dc loses this NTP time source it will opt for the hardware time source in the BIOS.
0
 
RickSheikhCommented:
In an only-two DC environment (which is what minimally what you should have). Opt for one physical.

VM based DCs have been far too prevalent and they are supported by MS.

Regarding the tim sync issue mentioned above, see my blog post http://www.shariqsheikh.com/blog/index.php/200912/time-synchronization-for-virtualized-dcs/
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

 
markterryAuthor Commented:
Thank you! that is very informative and exactly what I was hoping/expecting to hear.
0
 
RickSheikhCommented:
Only the PDCe (the FSMO role) should be setup as NTP (with an external source), the other DC(s) should be setup with NT5DS i.e setup to sync its time with the PDCe (by default).

http://support.microsoft.com/kb/816042
0
 
markterryAuthor Commented:
I guess I accepted the answer to the question a bit too early. Now I am a bit torn. So should I go virtual then?

I still think I will go for physical over virtual as if the host goes down, so do the virtuals, and I have to wait to be able to restore for AD to be online.

I will take heed the time issues, that is very informative, Thank you!
0
 
RickSheikhCommented:
0
 
markterryAuthor Commented:
Restore from a backup image (windows backup image) just as bad as well?
0
 
RickSheikhCommented:
True as it is an image, take a look at the links regarding the USN issue with doing so.
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

  • 4
  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now