Placemenr of Windows-2012 Active Directory FSMO Items on Domain Controlleres

Sorry for the high request but we are cutting over to a new AD Sunday morning and I just ran into an odd complication here.

We are in the process of upgrading from 2003 to 2012R2 Domain Controllers and have both of the new 2012R2 controllers running and in the domain with integrated DNS. The FSMO currently looks like this:

FSMO Roles in UAT
C:\>netdom query /domain:CNXUAT.com FSMO
Schema master               cnxuatdc01.cnxuat.com
Domain naming master        cnxuatdc01.cnxuat.com
PDC                         cnxuatdc01.cnxuat.com
RID pool manager            cnxuatdc01.cnxuat.com
Infrastructure master       cnxuatdc01.cnxuat.com
The command completed successfully.

Miocrosoft KB https://support.microsoft.com/en-us/help/255504/using-ntdsutil-exe-to-transfer-or-seize-fsmo-roles-to-a-domain-control says:

"Do not put the Infrastructure master role on the same domain controller as the global catalog server. If the Infrastructure master runs on a global catalog server it stops updating object information because it does not contain any references to objects that it does not hold. This is because a global catalog server holds a partial replica of every object in the forest."

SO would I set up as follows? Global Catalog is on both new and old Servers now so I'd remove it off newdc02 before the next steps?

Schema master               newdc01.cnxuat.com
Domain naming master        newdc01.cnxuat.com
PDC                        newdc01.cnxuat.com
RID pool manager            newdc01.cnxuat.com
Infrastructure master      newdc02.cnxuat.com
George R. KasicaLead Systems AdministratorAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Seth SimmonsSr. Systems AdministratorCommented:
you can have all the roles on a single server
splitting roles between servers is more for a much larger environment
i have never had to split roles between servers and never had issues with having both a GC and FSMO roles on 1 server

if you want to split between your domain controllers, that's fne - though i wouldn't remove dc02 as a GC; if dc01 goes down, now you have no global catalog server available (single point of failure) - assuming those are the only 2 domain controllers.
if you are running exchange, that is critical to have a GC always available
0
George R. KasicaLead Systems AdministratorAuthor Commented:
Ok that makes sense and yes we do. What would you suggest moving yo the second server if anything with about 500 VMs and 250 Users that doesn't strike me as a "large" environment by Microsoft's standards.
0
Seth SimmonsSr. Systems AdministratorCommented:
definitely not large
i would move the fsmo roles to one of the servers and just make sure both are GC
don't take the old ones down until there is nothing in the environment using it (dns, dhcp, etc.)
and whichever one you move the fsmo roles to, make sure you configure it as a time server and configure external time source
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

George R. KasicaLead Systems AdministratorAuthor Commented:
Already have the time part covered with an NTP client. All of our workstations and servers talk to them with the Meinberg NTP client. Thank you. Solved.
0
Lee W, MVPTechnology and Business Process AdvisorCommented:
I disagree - it's not about larger environments - it's about multi-domain environments (which are often but not always larger environments).

https://support.microsoft.com/en-us/help/223346/fsmo-placement-and-optimization-on-active-directory-domain-controllers
Quoting the above article:
In a forest that contains a single Active Directory domain, there are no phantoms. Therefore, the infrastructure master has no work to do. The infrastructure master may be placed on any domain controller in the domain, regardless of whether that domain controller hosts the global catalog or not.
0
George R. KasicaLead Systems AdministratorAuthor Commented:
We have a multiple forests but a single domain in each forest. Example cnxprod, cnxuat, ctcom each has its own forest and domain within there. So my thought was to place every roll on each of the 2 AD systems within each forest which is how its currently built and how the article you reference seems to indicate it will work best.
0
George R. KasicaLead Systems AdministratorAuthor Commented:
OK We tried to cutover today and have the items move to the new DCs and tried to move the existing IPs of the old DCs to the new Servers so each had 2 IPs on the interface new and old. Turned off both old servers and 99% of the servers we tried to connect to or login on console to failed with "No logon servers available" removing the IPs and powering the old DCs back up solved that issue. How do we go the last step and get the old DCs out of the forest and powered down here but move their IPs over?
0
Lee W, MVPTechnology and Business Process AdvisorCommented:
Whoa - what?  Are you trying to preserve the IPs?!  Why?!  And putting two IPs on a DC?  not advisable!

Did you run DCDIAG /C /E /V on All DCs prior to promoting and AFTER promoting to ensure everything was working right?

Not sure who advised you to keep the same IPs (or replace ALL DCs at once).

(This should probably be another question because your issues are not with FSMO placement anymore).
0
George R. KasicaLead Systems AdministratorAuthor Commented:
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2012

From novice to tech pro — start learning today.