Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Virtualizing the DC

Posted on 2013-11-19
8
Medium Priority
?
167 Views
Last Modified: 2014-05-27
I was wondering if I can get some feedback in regards to Virtualizing the Domain Controller.

I was told by some that Virtualizing ALL the DC's is not a good idea and that its best practice to have one PHYSICAL Domain Controller available just incase. Some say that virtualizing a DC and not have any PHYSICAL Domain Controller is not an issue as long as there is fault tolerance and the virtual hard drive file is accessible.

Any insight would be greatly welcomed.
0
Comment
Question by:Geekah
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
  • 2
  • +2
8 Comments
 
LVL 124
ID: 39659802
We do not have any physical Domain Controllers any more, and most of our clients no longer have any physical domain controllers.

Some clients, do like to prefer to be able to "touch and stroke" their DCs.

see here also

http://blogs.technet.com/b/askds/archive/2010/06/10/how-to-virtualize-active-directory-domain-controllers-part-1.aspx

What you must not do, if you use snapshots, for patch management, is rollback or Revert a DC using snapshots, but we think this is common sense, but Virtual Admins seem to forget this!
0
 
LVL 26

Accepted Solution

by:
pony10us earned 2000 total points
ID: 39659846
This is an ongoing point of contention within the IT community. There are points that suggest that either option is better than the other.

Personally, I prefer to keep one ADDC as a physical server just in case the VM host that houses any other ADDC's goes down. Others will say that to combat that you should keep multiple ADDC's on separate VM servers. Also, if the ADDC is located in the same physical location as the VM Host and there is a disaster (fire/flood/etc) then if it was a virtual and you had a backup it would be quicker to recover.

There are some that say it is a security risk to have an ADDC virtualized at all. Someone could get a copy of the VM and then have all the time they want to Brute Force attack it.

Again, it really comes down to your doing a full risk assessment and deciding on which risks are more acceptable and proceeding down that path.

Good luck and I'm sure there will be more informative responses to your inquiry.

You may also want to look at this:  http://www.techrepublic.com/blog/the-enterprise-cloud/considerations-for-virtualizing-all-active-directory-domain-controllers/

Some very good information in the comments at the end.
0
 
LVL 56

Expert Comment

by:andyalder
ID: 39660111
Had a client who setup their iSCSI and NFS targets using DNS rather than IP addresses, then they virtualized all their DCs which were also their only DNS servers. Oh what fun that was to get started again after a power-cut.
0
Automating Your MSP Business

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

 
LVL 96

Expert Comment

by:Lee W, MVP
ID: 39660314
Bottom line is you need to plan this.

First, what virtualization platform are you using?  VMWare or Hyper-V or something else?

If Hyper-V, are the Hyper-V servers joined to the domain?  If so, even though in 2012 you're supposed to be able to remove all physical DCs, I'd still prefer a physical.

Otherwise, you can be all virtual... PROVIDED you do things intelligently to accommodate that decision (see andyalder's comment).

You also have to plan security appropriately.  pony10us suggested an attacker could copy a VM... true... but if you use virtualization at all (and even if you don't), if a hacker can gain access to the network and a domain admin account, they could create a VM DC copy of a physical DC so I don't think that's a valid individual concern - that's more of a plan your security concern... what could someone do...
0
 
LVL 124
ID: 39660329
as an aside, we are seeing more and more larger clients, move DNS away from Windoze now, so DNS and AD are not tied!

So AD can still start because it has a depedancy on good working DNS! (e.g. DNS and AD are no the same server!) e.g. Infoxblox to name one product! Strange because one upon a time, Sun Solaris provided DNS, and then migrated to Novell - Microsoft, and now back again!
0
 
LVL 96

Expert Comment

by:Lee W, MVP
ID: 39660364
The DC running DNS has never been a requirement.  It's been a STRONG suggestion as AD required dynamic DNS and in most environments you don't have a huge mix of systems.  The most important thing is that WHATEVER server(s) run DNS, they need to be able to store and return to the clients upon request, service records about where AD resources are located.

In most environments, having the DC(s) as your DNS server(s) is still the most logical thing and for most people here, they shouldn't even consider NOT having DNS hosted by the DC (in my opinion).
0
 
LVL 56

Expert Comment

by:andyalder
ID: 39661018
>as an aside, we are seeing more and more larger clients, move DNS away from Windoze now, so DNS and AD are not tied!

It was more a generic warning against migrating a core service that virtualization relies on to a virtual platform rather than a poke at Windows. If they had virtualized all their Linux based DNS servers the same problem would have occurred - they virtualized something that virtualization relied on.
0
 

Author Closing Comment

by:Geekah
ID: 40093884
thanks everyone
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When we have a dead host and we lose all connections to the ESXi, and we need to find a way to move all VMs from that dead ESXi host.
David Varnum recently wrote up his impressions of PRTG, based on a presentation by my colleague Christian at Tech Field Day at VMworld in Barcelona. Thanks David, for your detailed and honest evaluation!
This course is ideal for IT System Administrators working with VMware vSphere and its associated products in their company infrastructure. This course teaches you how to install and maintain this virtualization technology to store data, prevent vuln…
In this video, Percona Solutions Engineer Barrett Chambers discusses some of the basic syntax differences between MySQL and MongoDB. To learn more check out our webinar on MongoDB administration for MySQL DBA: https://www.percona.com/resources/we…
Suggested Courses

610 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question