chris5472
asked on
Domain Controller and FSMO Roles
I was wondering if anyone could help me out with an issue we are having. We have 5 DCs in our environment. We have the FSMO roles set on two of the domain controllers, one dc has the Domain role owner and Schema owner roles. The other dc has the PDC, RID, and Infrastructure roles.
Today and in the past when the DC which handles the PDC, RID and Infrastructure roles goes down, our users can't get authenticated to our exchange server and also have issues logging into their workstations.
I assuming these roles aren't getting transferred when that DC goes down. Shouldn't this be done automatically or is this something we would need to do by running the FSMO transfer command. Once we got the server back up we didn't have any issues.
So I wondering why these roles don't get transferred...maybe something isn't setup right in our environment.
Thanks
Today and in the past when the DC which handles the PDC, RID and Infrastructure roles goes down, our users can't get authenticated to our exchange server and also have issues logging into their workstations.
I assuming these roles aren't getting transferred when that DC goes down. Shouldn't this be done automatically or is this something we would need to do by running the FSMO transfer command. Once we got the server back up we didn't have any issues.
So I wondering why these roles don't get transferred...maybe something isn't setup right in our environment.
Thanks
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
didnt understand what you mean by Going Down ?
Do you mean goes down as in restarts ?
or Goes down as in the OS is not bootable ?
You will need to seize the roles if the OS is not bootable or you need to demote the DC and move the roles to a better hardware to do a DC's job
Please clarify
Do you mean goes down as in restarts ?
or Goes down as in the OS is not bootable ?
You will need to seize the roles if the OS is not bootable or you need to demote the DC and move the roles to a better hardware to do a DC's job
Please clarify
Yes we have fully virtualized all our DCs, fully supported. See this question I helped with from a few days ago
https://www.experts-exchange.com/questions/27397689/Is-there-a-reason-not-to-virtualize-a-Domain-Controller-with-VMware.html
Only seize the roles if that DC is going to be down forever and not coming back up. Don't seize the roles and bring the original back up. Seizing is a drastic step.
Thanks
Mike
https://www.experts-exchange.com/questions/27397689/Is-there-a-reason-not-to-virtualize-a-Domain-Controller-with-VMware.html
Only seize the roles if that DC is going to be down forever and not coming back up. Don't seize the roles and bring the original back up. Seizing is a drastic step.
Thanks
Mike
as mkline71 says only seize the roles if you are up that familiar creek without a paddle.
The only caveat to the virtual DC's are - don't pause the VM's that will corrupt the AD Database
Careful with Time Sync on virtual DC's the clock can get a bit screwy under load
Make sure you have good backups of both the full VM and separate system state backups
don't rely on just Virtual VM's if you don't have resiliency in your storage other wise when it comes to a DR event and you have lost your SAN you aren't going to be able to do much
it saves hassle if you don't virtualise your DHCP server or at least have physical resiliency with it
The only caveat to the virtual DC's are - don't pause the VM's that will corrupt the AD Database
Careful with Time Sync on virtual DC's the clock can get a bit screwy under load
Make sure you have good backups of both the full VM and separate system state backups
don't rely on just Virtual VM's if you don't have resiliency in your storage other wise when it comes to a DR event and you have lost your SAN you aren't going to be able to do much
it saves hassle if you don't virtualise your DHCP server or at least have physical resiliency with it
Like mentioned earlier by Mike, make sure you have some Global Catalogs available so users can log in if the PDCe is down for maintenance.
cmd -> dsquery server -isgc
cmd -> dsquery server -isgc
ASKER
Thanks everyone for your help on this!!!
ASKER
Seize FSMO roles
To seize the FSMO roles by using the Ntdsutil utility, follow these steps:
1.Log on to a Windows 2000 Server-based or Windows Server 2003-based member computer or domain controller that is located in the forest where FSMO roles are being seized. We recommend that you log on to the domain controller that you are assigning FSMO roles to. The logged-on user should be a member of the Enterprise Administrators group to transfer schema or domain naming master roles, or a member of the Domain Administrators group of the domain where the PDC emulator, RID master and the Infrastructure master roles are being transferred.
2.Click Start, click Run, type ntdsutil in the Open box, and then click OK.
3.Type roles, and then press ENTER.
4.Type connections, and then press ENTER.
5.Type connect to server servername, and then press ENTER, where servername is the name of the domain controller that you want to assign the FSMO role to.
6.At the server connections prompt, type q, and then press ENTER.
7.Type seize role, where role is the role that you want to seize. For a list of roles that you can seize, type ? at the fsmo maintenance prompt, and then press ENTER, or see the list of roles at the start of this article. For example, to seize the RID master role, type seize rid master. The one exception is for the PDC emulator role, whose syntax is seize pdc, not seize pdc emulator.
8.At the fsmo maintenance prompt, type q, and then press ENTER to gain access to the ntdsutil prompt. Type q, and then press ENTER to quit the Ntdsutil utility.
I was also wondering if anyone has VM'd their DCs. We are running VMWare 4.0 and have virtualized all but one DC. This DC has PDC, RID and Infrastructure roles, I pretty sure Microsoft doesn't support DCs that are VM'd.
My thinking is transferring the 3 roles to one of the virtualized DC's and be done with it....what do you guys think? But i'm just worried that we won't get support from MS if we have any issues in the future.
Thanks