[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

FSMO Ro es 2 DC's

Posted on 2011-10-03
18
Medium Priority
?
340 Views
Last Modified: 2012-08-14
I have 2 domain controllers setup supporting about 30 users. I want to keep the network as redundant as possible, now i have the 5 roles split between 2 servers.

Is there a recommendation from Microsoft as to how to split the roles between 2 servers? As in which one should go on which?
0
Comment
Question by:Cobra25
  • 6
  • 5
  • 4
  • +2
18 Comments
 
LVL 11

Expert Comment

by:Renato Montenegro Rustici
ID: 36903381
You can enable all roles in one server or mix them. To avoid certain unsupported combinations, enable the Global Catalog in both servers.
0
 
LVL 11

Expert Comment

by:Renato Montenegro Rustici
ID: 36903406
If a dc fails, then you can seize the roles to the surviving server. Take a look at this document:

Using Ntdsutil.exe to transfer or seize FSMO roles to a domain controller
support.microsoft.com/kb/255504

Keep in mind that you must take daily system state backups of your DCs.
0
 
LVL 4

Author Comment

by:Cobra25
ID: 36903443
I have setup both servers as GC's. If i have all the roles on one server, and if that were server were to die then i would have to force a seize on all the roles.
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 36903451
There is no possibility to "replicate" FSMO roles between DCs as the only one FSMO role can exist within environment.
There is no problem with that. FSMO roles are not used every day. More, when you have more DCs in your environment and you do not monitor them, you probably would know that FSMO holder is broken after soooooommmeeee time ;)

FSMO roles can be simply transfer between DCs if necessary or even after hard FSMO holder crash, seized using NTDSUTIL

However, you can always split them. On one DC leave Schema Master and Domain Naming Master (forest-wide roles) and on another place (RID, PDC Emulator and Unfrastructure Master).

After you change PDC Emulator master, re-advertise Time Server in your forest

[...]- after transfer of the PDCEmulator role, configure the NEW PDCEmulator to an external timesource and reconfigure the old PDCEmulator to use the domainhierarchie now. Therefore run on the NEW "w32tm /config /manualpeerlist:PEERS /syncfromflags:manual /reliable:yes /update" where PEERS will be filled with the ip address or server(time.windows.com) and on the OLD one run "w32tm /config /syncfromflags:domhier /reliable:no /update" and stop/start the time service on the old one. All commands run in an elevated command prompt without the quotes. [...]

as extract from MVP blog at
http://msmvps.com/blogs/mweber/archive/2010/02/10/upgrading-an-active-directory-domain-from-windows-server-2003-to-windows-server-2008-or-windows-server-2008-r2.aspx

Regards,
Krzysztof
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 36903464
Check that article about seizing FSMO roles on my blog if you're interested at
http://kpytko.wordpress.com/2011/08/28/seizing-fsmo-roles/

Krzysztof
0
 
LVL 4

Author Comment

by:Cobra25
ID: 36903483
Yes i know there is no way to replicate them. I was just wondering what is best practice in a 2 DC environment. I run full backups on the servers every night including system state. However i dont think the system state backup will help on a server that has completely died and cannot be brought back to life.
0
 
LVL 39

Assisted Solution

by:Krzysztof Pytko
Krzysztof Pytko earned 1000 total points
ID: 36903517
Yup, that it's very important to have redundant servers with AD/DNS as best practices. And of course do regurarly system state backup. It's mote likely that both of them will die in the same times. If so, you're bad luck guy ;)

Krzysztof
0
 
LVL 37

Accepted Solution

by:
Neil Russell earned 1000 total points
ID: 36903546
There is in practicality no "Best Way" to hold the FSMO roles between two servers in the domain at the same location. If on dies you are going to have to sieze roles anyway if you split them up.

There is no practical benefit to splitting them across servers, unlesss you KNOW one is unreliable.

(In that case, get rid of the server and buy a new one!! )
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 36903558
I agree with Neilsr

Don't worry about FSMO roles, take care about AD database :) That's the most important!

Krzysztof
0
 
LVL 4

Author Comment

by:Cobra25
ID: 36903573
Thanks guys. I know when you have exchange installed in your environment, I've read that MS recommends that 2 of the roles do not reside on the  same server (I do not remember the exact ones however)
0
 
LVL 11

Expert Comment

by:Renato Montenegro Rustici
ID: 36903575
The only caveat that you should take care is if you seize a role, dont bring back the old server anymore. This can cause inconsistencies in the AD database or unpredictable results. If a server dies and you seize a role, never bring that server back by restoring a system state backup. Just install ADDS and dcpromo the server to the domain.

If you turn on Global Catalog on both servers, you can distribute the roles at will.
0
 
LVL 11

Expert Comment

by:Renato Montenegro Rustici
ID: 36903610
You should not enable Infrastructure Master and the Global Catalog in the same saver. But, there are tree exceptions:

1) You have only one domain.
2) There's only one domain controller.
3) All your domain controllers are global catalogs.
0
 
LVL 37

Expert Comment

by:Neil Russell
ID: 36903647
I would guess that with 30 users it is quite obvious that its a single domain with 2 servers and we already know that both are GC so pointless facts really rmrustice....
0
 
LVL 11

Expert Comment

by:Renato Montenegro Rustici
ID: 36903682
Pointless to us that are aware of how it works. Just explaing him why we recommended that rules.
0
 
LVL 70

Expert Comment

by:KCTS
ID: 36904077
I support what has already been said by some, there is absolutely no point in splitting the FSMO roles across servers if you have a single domain. Only if you have multiple domains and  if not all DCs are Global Catalog servers do you need to split the Infrastructure Master Role from the Global Catalog holder.
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 36915753
Hi,

do you need any further help in this topic? Please, let us know

Thanks in advance

Krzysztof
0
 
LVL 4

Author Comment

by:Cobra25
ID: 36915756
All good. Will assign points shortly. Thanks
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 36915764
That's not about points :) Just wanted to know if you need any other help :)

Krzysztof
0

Featured Post

Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Active Directory can easily get cluttered with unused service, user and computer accounts. In this article, I will show you the way I like to implement ADCleanup..
High user turnover can cause old/redundant user data to consume valuable space. UserResourceCleanup was developed to address this by automatically deleting user folders when the user account is deleted.
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
Suggested Courses

867 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question