Solved

Adding new Domain Controller FSMO role placement best practice in multi location Office.

Posted on 2014-10-21
7
805 Views
Last Modified: 2014-10-23
Hi,

Can someone please suggest me what is the best way to deploy Active Directory domain controller FSMO role in my scenario where all of my users are in the Head office building while all of the servers are running in primary Data Center and Secondary Data Center ?

The layout is as follows:

Head Office - City 1:
User workstations
AD Site: Head-Office
HO-PRODDC1 (Role: Secondary DNS, DHCP, Global Catalog, …FSMO Role ?...)
HO-PRODDC2 (Role: Secondary DNS, Global Catalog, …FSMO Role ?...)

Production DataCenter – City 1:
AD Site: City1-DC1
Exchange Server 2010 – DAG Node 1 (active)
SharePoint Server 2010
DC1-PRODDC1 (Role: Primary DNS, Global Catalog, …FSMO Role ?...)
DC1-PRODDC2 (Role: Secondary DNS, Global Catalog, …FSMO Role ?...)

DR DataCenter – City 2:
AD Site: City2-DC2
Exchange Server 2010 – DAG Node 2 (passive)
DC2-RECODC1 (Role: Secondary DNS, Global Catalog, …FSMO Role ?...)
DC2-RECODC2 (Role: Secondary DNS, Global Catalog, …FSMO Role ?...)

I just need to know where to put or transfer the FSMO role from the existing old Windows Server 2003 AD physical box from the Head office server room into the various Data Center new VMs.

Thanks in advance.
0
Comment
  • 4
  • 3
7 Comments
 
LVL 34

Assisted Solution

by:Seth Simmons
Seth Simmons earned 500 total points
ID: 40396175
you're not required to spread them out across different sites
you can keep on one server or split between the 2 servers at the head office
having GC at the remote locations are more critical
0
 
LVL 7

Author Comment

by:Senior IT System Engineer
ID: 40396178
ok, what about making the two Domain Controller server in the Production City1 Data Center holding all the roles ?

while the Head office just normal Domain Controllers with Global Catalog only with DNS & DHCP, would that preferable best practice ?

or what's the impact or risk in doing that since no FSMO role is running in the Head Office Domain controllers?
0
 
LVL 34

Assisted Solution

by:Seth Simmons
Seth Simmons earned 500 total points
ID: 40396195
it's irrelevant if a domain controller holding fsmo roles also is running network services like dns and dhcp
also irrelevant what site they are in
as long as everyone knows who the correct role holders are and they can contact each other - that is what matters
microsoft does recommend spreading them out in large environments but seems yours isn't that big at all so it shouldn't matter

your schema master is only needed when extending the schema for things like exchange service packs and upgrades, first domain controller of a new windows version.   the domain naming master is needed naming of multiple domains in your forest (if you have it).  infrastructure master manages objects in multiple domains in the forest (again, if you have multiple domains).  the rid master and pdc emulator would be the ones most often used

Active Directory FSMO roles in Windows
https://support2.microsoft.com/kb/197132?wa=wsignin1.0
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 7

Author Comment

by:Senior IT System Engineer
ID: 40396199
Ah I see,

I was worried if I placed the PDC role into the production Data Center Domain Controllers, it would slows down user login time in the head office due to the communication across dark fibre WAN link.

or if I placed the PDC role into the Head Office domain controller in server room, email send and receive would be slower since Exchange must communicate across dark fibre WAN link.

is that true or it doesn't really matter where the FSMO role is running as long as there is DC/Global Catalog in each sites ?
0
 
LVL 34

Accepted Solution

by:
Seth Simmons earned 500 total points
ID: 40396215
correct
GC is critical for user logons and exchange
0
 
LVL 7

Author Comment

by:Senior IT System Engineer
ID: 40396222
Cool, so I'll implement the solution as follows:

Production DataCenter – City 1:
AD Site: City1-DC1
Exchange Server 2010 – DAG Node 1 (active)
SharePoint Server 2010
DC1-PRODDC1 (Role: Primary DNS, Global Catalog, Schema master and Domain master)
DC1-PRODDC2 (Role: Secondary DNS, Global Catalog, RID master, Infrastructure master and PDC emulator)

while the head office server room DC just holding the Global Catalog server role. Hopefully no user login issue or email slowness issue arise from the above setup.
0
 
LVL 7

Author Closing Comment

by:Senior IT System Engineer
ID: 40398665
Thanks !
0

Featured Post

Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

MS Outlook is a world-class email client application that is mainly used for e-communication globally.  In this article, we will discuss the basic idea about MS Outlook, its advanced features, and types of MS Outlook File formats.
Find out what you should include to make the best professional email signature for your organization.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of installing of Data Protection Manager on a server running Windows Server 2012 R2, including the prerequisites. Microsoft .Net 3.5 is required. To install this feature, go to Server Manager…

895 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now