Solved

Virtualizing the DC

Posted on 2013-11-19
8
160 Views
Last Modified: 2014-05-27
I was wondering if I can get some feedback in regards to Virtualizing the Domain Controller.

I was told by some that Virtualizing ALL the DC's is not a good idea and that its best practice to have one PHYSICAL Domain Controller available just incase. Some say that virtualizing a DC and not have any PHYSICAL Domain Controller is not an issue as long as there is fault tolerance and the virtual hard drive file is accessible.

Any insight would be greatly welcomed.
0
Comment
Question by:Geekah
  • 2
  • 2
  • 2
  • +2
8 Comments
 
LVL 118
ID: 39659802
We do not have any physical Domain Controllers any more, and most of our clients no longer have any physical domain controllers.

Some clients, do like to prefer to be able to "touch and stroke" their DCs.

see here also

http://blogs.technet.com/b/askds/archive/2010/06/10/how-to-virtualize-active-directory-domain-controllers-part-1.aspx

What you must not do, if you use snapshots, for patch management, is rollback or Revert a DC using snapshots, but we think this is common sense, but Virtual Admins seem to forget this!
0
 
LVL 26

Accepted Solution

by:
pony10us earned 500 total points
ID: 39659846
This is an ongoing point of contention within the IT community. There are points that suggest that either option is better than the other.

Personally, I prefer to keep one ADDC as a physical server just in case the VM host that houses any other ADDC's goes down. Others will say that to combat that you should keep multiple ADDC's on separate VM servers. Also, if the ADDC is located in the same physical location as the VM Host and there is a disaster (fire/flood/etc) then if it was a virtual and you had a backup it would be quicker to recover.

There are some that say it is a security risk to have an ADDC virtualized at all. Someone could get a copy of the VM and then have all the time they want to Brute Force attack it.

Again, it really comes down to your doing a full risk assessment and deciding on which risks are more acceptable and proceeding down that path.

Good luck and I'm sure there will be more informative responses to your inquiry.

You may also want to look at this:  http://www.techrepublic.com/blog/the-enterprise-cloud/considerations-for-virtualizing-all-active-directory-domain-controllers/

Some very good information in the comments at the end.
0
 
LVL 55

Expert Comment

by:andyalder
ID: 39660111
Had a client who setup their iSCSI and NFS targets using DNS rather than IP addresses, then they virtualized all their DCs which were also their only DNS servers. Oh what fun that was to get started again after a power-cut.
0
 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 39660314
Bottom line is you need to plan this.

First, what virtualization platform are you using?  VMWare or Hyper-V or something else?

If Hyper-V, are the Hyper-V servers joined to the domain?  If so, even though in 2012 you're supposed to be able to remove all physical DCs, I'd still prefer a physical.

Otherwise, you can be all virtual... PROVIDED you do things intelligently to accommodate that decision (see andyalder's comment).

You also have to plan security appropriately.  pony10us suggested an attacker could copy a VM... true... but if you use virtualization at all (and even if you don't), if a hacker can gain access to the network and a domain admin account, they could create a VM DC copy of a physical DC so I don't think that's a valid individual concern - that's more of a plan your security concern... what could someone do...
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 118
ID: 39660329
as an aside, we are seeing more and more larger clients, move DNS away from Windoze now, so DNS and AD are not tied!

So AD can still start because it has a depedancy on good working DNS! (e.g. DNS and AD are no the same server!) e.g. Infoxblox to name one product! Strange because one upon a time, Sun Solaris provided DNS, and then migrated to Novell - Microsoft, and now back again!
0
 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 39660364
The DC running DNS has never been a requirement.  It's been a STRONG suggestion as AD required dynamic DNS and in most environments you don't have a huge mix of systems.  The most important thing is that WHATEVER server(s) run DNS, they need to be able to store and return to the clients upon request, service records about where AD resources are located.

In most environments, having the DC(s) as your DNS server(s) is still the most logical thing and for most people here, they shouldn't even consider NOT having DNS hosted by the DC (in my opinion).
0
 
LVL 55

Expert Comment

by:andyalder
ID: 39661018
>as an aside, we are seeing more and more larger clients, move DNS away from Windoze now, so DNS and AD are not tied!

It was more a generic warning against migrating a core service that virtualization relies on to a virtual platform rather than a poke at Windows. If they had virtualized all their Linux based DNS servers the same problem would have occurred - they virtualized something that virtualization relied on.
0
 

Author Closing Comment

by:Geekah
ID: 40093884
thanks everyone
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
*** Hardware Malfunction Dell T610 7 57
Wireshark coloring help 4 43
Wireshark 7 55
Use of Training Budget 12 71
#Citrix #Citrix Netscaler #HTTP Compression #Load Balance
In this article, I will show you HOW TO: Perform a Physical to Virtual (P2V) Conversion the easy way from a computer backup (image).
In this video tutorial I show you the main steps to install and configure  a VMware ESXi6.0 server. The video has my comments as text on the screen and you can pause anytime when needed. Hope this will be helpful. Verify that your hardware and BIO…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now