Solved

Move FSMO Roles from Physical Server and Decomission DC

Posted on 2013-01-10
14
538 Views
Last Modified: 2013-01-17
Good day everyone. We currently have 4 Domain Controllers in our domain. The domain controller holding the FSMO roles is a very old Windows 2000 server. We would like to transfer the roles to a newer DC and decommission it.

 Here is our layout:

    FSMO role holder is a physical server, other 3 are VMs on different hosts (using Hyper-V)

    The 3 other DCs are on Windows 2003 SP2


Would it be a good idea to have all DCs as VMs or should at least one be on a physical machine?

In a previous question, a fellow member informed me that the Hyper-V servers should be set in a workgroup (because if they are in the domain and all DCs are virtual, they boot up and there is no DC available until the Hyper-V server finishes loading and starts the VM.

I understand this but I have all Hosts in the domain as I use GP and for authentication purposes. Would the only way around this be to have a physical DC?
0
Comment
Question by:mig1980
  • 6
  • 6
  • 2
14 Comments
 
LVL 8

Assisted Solution

by:s3e3
s3e3 earned 167 total points
ID: 38765444
I highly recommend you have one domain controller on a physical server. The others can certainly be on VM's. You don't want to have to deal with time sync issues, having one physical host is good practice.
0
 

Author Comment

by:mig1980
ID: 38765473
Would it be OK to have the FSMO role holding DC also be a VM Host? I am trying to avoid having one extra piece of hardware if at all possible, but not if it will cause any issues.
0
 
LVL 8

Assisted Solution

by:s3e3
s3e3 earned 167 total points
ID: 38765508
You can certainly decide to virtualize all AD guests but you will need to read a couple of white papers. there is a good one by vmware called "Virtualizing a Windows Active Directoy
Domain Infrastructure". It talks about how to deal with clock drift in a vm.

Sorry don't have the link handy.
0
 
LVL 23

Assisted Solution

by:Suliman Abu Kharroub
Suliman Abu Kharroub earned 333 total points
ID: 38765511
It is strongly reommanded to have at least one physical DC on the doamin.


Things to consider when you host Active Directory domain controllers in virtual hosting environments:
http://support.microsoft.com/kb/888794
0
 

Author Comment

by:mig1980
ID: 38769071
Thank you for this information. My only remaining concern is how to handle a potentially situation where all servers have to be shutdown for maintenance. Given that the FSMO DC would also be a VM, as well as the remaining DCs, that would mean that the host machines (which are also on the domain) would be the first to start.

What type of issues would be noticeable and are there ways around this issue?
0
 
LVL 23

Assisted Solution

by:Suliman Abu Kharroub
Suliman Abu Kharroub earned 333 total points
ID: 38769080
Id depends on which FSMO role is not availvle:

1. Domain nameiing : th eimpact is you can't add/delete domain.
2.Infrustructre: no impact in single domain forest.
3. RID: Cant add users/comuters to domain.
4. Schema: can't make any modifications on schema such as prepare schema for exchange installation
5. PDC: can't reset passwords/ source time is not availbe...etc

the most important (impact) are RID and PCD.

and excelent artice about FSMO:
http://www.experts-exchange.com/Software/Server_Software/File_Servers/Active_Directory/A_2796-Demystifying-the-Active-Directory-FSMO-Roles.html
0
 

Author Comment

by:mig1980
ID: 38769095
Well, all roles would be on one DC. I am only referring to the impact of the DC not being on before the VM Hosts. The impacts you are referring to above are impacts to changes being made, with the exception of source time.
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 23

Expert Comment

by:Suliman Abu Kharroub
ID: 38769106
If you get your point correct, you are refaring to the order of starting the DCs up ?

If so, no empact. if the FSMO hloder was started up before othor DC there is no impact on the domain.
0
 

Author Comment

by:mig1980
ID: 38769116
Not quite. I was referring to the Host that FSMO DC resides on being started first, next the FSMO holder, and all the remaining servers.
0
 
LVL 23

Assisted Solution

by:Suliman Abu Kharroub
Suliman Abu Kharroub earned 333 total points
ID: 38769127
For the host server it will fail communicating with the DC to get computer policies...

here is another good article describing all the process :

http://www.petri.co.il/domain-controller-virtualization-options.htm

"Keep the Hyper-V servers out of the domain, i.e. leave it in a workgroup, and virtualize the DCs – This will mostly work for small deployments where you can consider leaving the Hyper-V servers as part of a workgroup and then running all domain controllers inside virtual machines, just like any other VM.  There are 2 problems in this approach:  First, you lose the security advantages of running Hyper-V servers in a domain environment; and second, when more than a couple of Hyper-V servers need to be managed in this manner, it is hard to have multiple administrators in such an environment.  Another drawback of this approach is that you will not be able to use all the functionality of SCVMM 2008."
0
 

Author Comment

by:mig1980
ID: 38769144
I understand the host would fail to communicate but would I am trying to figure out is whether any serious issues would arise by having this happen?

Not interested in having the Host hyper-v servers in workgroup environment for the reasons named.
0
 
LVL 23

Accepted Solution

by:
Suliman Abu Kharroub earned 333 total points
ID: 38769156
I can'r remember any of these issues now....

Running all DCs on VMS is really a risk for the reasion which mentioned on the article, so it is highly recommanded to run the root Dc  on a physical server.... I would not take this risk (my personal opinion).
0
 

Author Comment

by:mig1980
ID: 38769159
That's exactly what I wanted to hear. I knew it was a risk but wanted people's opinion on whether the pros outweighed the cons. Don't think so. I have the hardware to make this happen physically but wanted to try and reduce my footprint. Oh well, one more server to maintain. Thank you for your help.
0
 
LVL 23

Expert Comment

by:Suliman Abu Kharroub
ID: 38769221
You are welcome!

please close the quesiton if you get the answer.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

[b]Ok so now I will show you how to add a user name to the description at login. [/b] First connect to your DC (Domain Controller / Active Directory Server) SET PERMISSIONS FOR SCRIPT TO UPDATE COMPUTER DESCRIPTION TO USERNAME 1. Open Active …
On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now