Adding new Domain Controller FSMO role placement best practice in multi location Office.

Hi,

Can someone please suggest me what is the best way to deploy Active Directory domain controller FSMO role in my scenario where all of my users are in the Head office building while all of the servers are running in primary Data Center and Secondary Data Center ?

The layout is as follows:

Head Office - City 1:
User workstations
AD Site: Head-Office
HO-PRODDC1 (Role: Secondary DNS, DHCP, Global Catalog, …FSMO Role ?...)
HO-PRODDC2 (Role: Secondary DNS, Global Catalog, …FSMO Role ?...)

Production DataCenter – City 1:
AD Site: City1-DC1
Exchange Server 2010 – DAG Node 1 (active)
SharePoint Server 2010
DC1-PRODDC1 (Role: Primary DNS, Global Catalog, …FSMO Role ?...)
DC1-PRODDC2 (Role: Secondary DNS, Global Catalog, …FSMO Role ?...)

DR DataCenter – City 2:
AD Site: City2-DC2
Exchange Server 2010 – DAG Node 2 (passive)
DC2-RECODC1 (Role: Secondary DNS, Global Catalog, …FSMO Role ?...)
DC2-RECODC2 (Role: Secondary DNS, Global Catalog, …FSMO Role ?...)

I just need to know where to put or transfer the FSMO role from the existing old Windows Server 2003 AD physical box from the Head office server room into the various Data Center new VMs.

Thanks in advance.
LVL 9
Senior IT System EngineerIT ProfessionalAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Seth SimmonsSr. Systems AdministratorCommented:
you're not required to spread them out across different sites
you can keep on one server or split between the 2 servers at the head office
having GC at the remote locations are more critical
0
Senior IT System EngineerIT ProfessionalAuthor Commented:
ok, what about making the two Domain Controller server in the Production City1 Data Center holding all the roles ?

while the Head office just normal Domain Controllers with Global Catalog only with DNS & DHCP, would that preferable best practice ?

or what's the impact or risk in doing that since no FSMO role is running in the Head Office Domain controllers?
0
Seth SimmonsSr. Systems AdministratorCommented:
it's irrelevant if a domain controller holding fsmo roles also is running network services like dns and dhcp
also irrelevant what site they are in
as long as everyone knows who the correct role holders are and they can contact each other - that is what matters
microsoft does recommend spreading them out in large environments but seems yours isn't that big at all so it shouldn't matter

your schema master is only needed when extending the schema for things like exchange service packs and upgrades, first domain controller of a new windows version.   the domain naming master is needed naming of multiple domains in your forest (if you have it).  infrastructure master manages objects in multiple domains in the forest (again, if you have multiple domains).  the rid master and pdc emulator would be the ones most often used

Active Directory FSMO roles in Windows
https://support2.microsoft.com/kb/197132?wa=wsignin1.0
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

Senior IT System EngineerIT ProfessionalAuthor Commented:
Ah I see,

I was worried if I placed the PDC role into the production Data Center Domain Controllers, it would slows down user login time in the head office due to the communication across dark fibre WAN link.

or if I placed the PDC role into the Head Office domain controller in server room, email send and receive would be slower since Exchange must communicate across dark fibre WAN link.

is that true or it doesn't really matter where the FSMO role is running as long as there is DC/Global Catalog in each sites ?
0
Seth SimmonsSr. Systems AdministratorCommented:
correct
GC is critical for user logons and exchange
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Senior IT System EngineerIT ProfessionalAuthor Commented:
Cool, so I'll implement the solution as follows:

Production DataCenter – City 1:
AD Site: City1-DC1
Exchange Server 2010 – DAG Node 1 (active)
SharePoint Server 2010
DC1-PRODDC1 (Role: Primary DNS, Global Catalog, Schema master and Domain master)
DC1-PRODDC2 (Role: Secondary DNS, Global Catalog, RID master, Infrastructure master and PDC emulator)

while the head office server room DC just holding the Global Catalog server role. Hopefully no user login issue or email slowness issue arise from the above setup.
0
Senior IT System EngineerIT ProfessionalAuthor Commented:
Thanks !
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.