Link to home
Start Free TrialLog in
Avatar of ahmad1467
ahmad1467Flag for United States of America

asked on

Seting up a backup domain controller

I have a windows 2003 Domain controller that also serves as a DNS and a DHCP server; I also have a Windows 2003 server with Exchange server running on it, the other function of the Exchange is a secondary DNS server. We have just migrated off the Exchange server to an online hosted Exchange server and they want me do away with the old Exchange server. The down fall of this is there are several of our web sites that have the old Exchange server IP address hard coded in the scripts for outbound emails, both of these servers are VM servers.

Now my company wants me create new server with two functions:
•      Backup Domain controller so that if the main Domain controller goes down at any time the backup would kick in until the main controller is backup
•      SMTP Relay for our outgoing automated email programs.

Questions
Can I have a Backup domain controller?
Should I create a completely new server or can I uninstall Exchange and use the old Exchange server.

Thanks
Avatar of steinmto
steinmto
Flag of United States of America image

You can always have a backup domain controller and yes to do it you can uninstall exchange.
It may be cleaner to rebuilt but you can use the old one.
Avatar of Adam Brown
The backup domain controller part is pretty easy. All you have to do is promote a second server to be a Domain Controller. Once that's done failover is mostly automatic. The SMTP relay might be a little trickier, though.
Avatar of ahmad1467

ASKER

If I create a new server do you see it being a problem with using the IP address of the old Exchange server once I shut it down.

Why do you say the SMTP part might be a little trickier?

There shouldn't be any problems re-using the IP address. SMTP relay is tricky because the SMTP functions of Windows Server without Exchange are very very limited. I haven't messed with it much, so I don't know if Relay is possible with just the built in SMTP Server functionality.
I've done it.  It should work with just the Defaults on everything.   Since the mail clients (the scripts on the websites in this case) are going to be coming from internal LAN IP#s (at least I assume they are) it should be fine.

By default the SMTP Service allows relaying from the LAN IP Range and also from any user account that authenticates.  Even if I am mistaken about it being the default setting it is still no big deal just to tell it to do that.  The only other thing you have to tell the SMTP Service is what upstream smart host to use if that is what is desired,...otherwise it will send direct to the destiantion mail server determined by MX lookups.

BTW - side thing,...this kinda shows why it is a bad idea to hardcode IP# into scripts.  With this being web services It might be better to have the IP#s in an application variable such as:

Application("mailip") = 192.168.1.1

and then just have all the scripts use Application("mailip") to retreive the data.  Then when the IP#s change you just change the Application level variables.
Just a thought.
Could also install SMTP on the Web Server itself,...it already has IIS anyway.  Then it can use LocalHost or 127.0.0.1 in the Scripts and you wouldn't have to worry about it anymore.
Ok I have created the new server and I have SMTP working.
Now the old Exchange server was also the secondary DNS server but I am getting rid of it,
I have just change the IP address of the old Exchange server and gave the old IP to the new SMTP server.
Now I would like to make this new SMTP server the secondary DNS and the Backup domain controller
Can this be done also?
Do I need to do anything to the old Exchange/Second DNS server before shutting it down?

Thanks
ASKER CERTIFIED SOLUTION
Avatar of pwindell
pwindell
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
The second DC:
You can have SMTP and a DC on the same machine,...but IMO, not a great idea.  My DCs run DNS, DHCP, and WINS,..that is all and I am very strict about it.

Anyway...
1. The machine needs to be a domain member (probably already is by now)
2. Install the DNS Service, but do not configure it, just leave it sit.
3. Set the DNS in the TCP/IP specs of the Nic to to the existing DC
4. Run DCPromo from a command prompt and tell it that you are adding a DC to an existing Domain in an existing Forest.
5. When finished and before rebooting set the DNS in the TCP/IP Specs of the Nic to be the exsiting DC first,..and itself second,...and 127.0.0.1 thirdly.  The third one is a new recommendation that I have been seeing and consider it optional.  The first two there is always going to be debate over which order they should be in,....so this is my recommendation I am giving you.  Repeat the same idea on the original DC
Don't forget on both DCs to add the DNS Forwarders to the Config within the DNS MMC on each.  Every machine on the LAN must use only the AD/DNSs for their DNS and never anything else.  The only place you should ever see any outside DNS listed would be in the Forwarders List.   Be sure the Firewall allows the DCs to make outbound DNS queries,..it is also a good idea to set the firewall to Deny any DNS queries from anything else to prevent rogue DNS settings on clients on the LAN or to also hamper Malware infections from making independent outbound DNS queries to outside rogue DNS Servers.

After looking at article in http://support.microsoft.com/kb/822931 it looks like theses directions are for if I had another Exchange server in my environment, is this true?
Logically you can not have a First Exchange if you never had a "second" Exchange,...and logically you can not have a Last Exchange if there was not one or more Exchanges before that one.  However, if you only have one Exchange,...then it is both the First and the Last Exchange at the same time,...so elements of both those articles apply and have to be considered.

So you deal with the pieces of each article that fit you,..ignore the parts that don't apply.  Most likely the article for the Last Exchange will be the most applicable to you.  There may be very few if any things from the First Exchange article that apply,...but you need to be mentally aware of all the aspects of it and the reasons for it just the same.
Ok before I got you first message from you I had created a new server and gave it the IP address of the Exchange server and assigned the Exchange server DHCP settings then I switched it back but I never changed anything on the Domain controller could this have done something because now if I do a {nslookup IP} I get:

C:\Documents and Settings\user.ALLIED>nslookup 192.168.15.6
*** Can't find server name for address 192.168.15.6: Non-existent domain
*** Can't find server name for address 192.168.15.20 Non-existent domain
*** Default servers are not available
Server:  UnKnown
Address:  192.168.15.6

*** UnKnown can't find 192.168.15.6: Non-existent domain
Exchange should never be involved in DHCP,...it needs static unchanging IP#s.

NSLookup,...well I've been messing with this stuff for over a decade and I think I have maybe used NSLookup,...hmmm,...3 times?  There is just too many simpler ways to deal with things.

All you have to worry about is if you ping the Exchange Server by the Netbios Name and by the FQDN it returns the correct IP# of the Exchange Server.  If not, then shutdown the original Exchange delete any "rogue" DNS entries created in DNS or WINS by you previous actions and start the Exchange back up so it will re-register itself with DNS and WINS.  If the new server is up and is using the IP# the Exchange previously had then just give the original Exchange a new static IP,...it really does not matter squat what IP the Exchange has now just as long as it is static and is properly registered in DNS and WINS. Exchange is refered to in AD by the Netbois name or FQDN,..not by IP#.

Anyway,...if the Exchange box is running and is reasonably "healthy" read the articles and decommission it properly and gracefully and you should be fine.
Now that I have taken my Exchange server out of the domain is their a way for me to check to see is everthing is OK?

Thanks
Run DCDIAG
Run NetDIAG

Watch the event log in the Event Viewer on the DCs.

There are not typically any problems after removing Exchange as long as you followed the correct procedures.  It is usually very dependable.

Me being the simple kinda guy I am,...If everything works, then everything is fine,...if something ain't workin' right then it's broke.
I did run into a few problems. On one of my serves in my domain is having some problems with the services some of the ones that were using logon stop working, then when I tried to use a different user and brows to find the user it sees the user but when I select apply I get a message that says {The specific domain ether does not exist or could not be contacted}. I did run
I did run dcdiag & net diag and I did see some this that did look like it might be a problem did you want me to post the report?

Thanks
I just need to know what Service it is and what it is using as a Service User account.  Most Services run off of just the built in "System Account".

In any case that would have nothing to do with removing Exchange.  This would have pre-existed you Exchange removal.

If you post the DCDiag only post the relevant part,...don't bomb the thread with the whole thing,..they are too long to deal with,...at least for me anyway.

Another thing that might be a good idea is to start a new thread to deal specifically with your current DCs and Domain "as it sits" with Exchange no longer being part of the conversation.  This thread is starting to get excessively long.
OK thans for all your help I will create a new thread.