Block Based replication of Domain Controllers to DR site

Question

I have to bring up a business critical application at a DR site using the same hostname and IP address as in production site. For this purpose, I plan to use a block replication software to replicate data from production servers to a SAN at the DR site.
For DR invocation or testing, I am planning to take a snapshot from the SAN, create virtual disks and attach them to newly created VM's at the DR site.
This application depends on Active Directory and hence I need to have a domain controller at the DR site. If I create a new domain controller for the DR site, as it will be in a separate IP subnet, it will have to be in a separate AD site and the application
servers will not be able to use this domain controllers, as they will look for domain controllers in their AD site (which is from the production site). If I put the domain controller in the same IP subnet as the application servers, the same IP subnet has
user workstations and hence user authentication requests from production site will start coming to the DR site across the WAN.
In this scenario, I am proposing to replicate the domain controllers also from the production site to the DR site, like the application servers. But I am not sure if block replication of production DC's to DR site and then when required for testing/invocation,
can we create a new VM and attaching virtual hard disks with the replicated data, will bring these VM's up as domain controllers in the DR site or will they have any negative effects ? Would this be a supported solution ? Any response will be highly appreciated.
Thanks in advance.

Answer 1

You don't want to run any type of duplicated software to clone the DC, that is a bad idea.  You could end up with lingering objects and/or Directory Service corruption. 
If you want the DC's to exist in the same subnet then you are in a quandry.  You can start to modify srv records so the DC won't authenticate clients (BUt you will have to manually change that at DR time).
I have a Blog that talks about lag site replication that blocks clients from ever attempting to authenticate to the DC, you should be able to use this same logic.
http://blogs.dirteam.com/blogs/paulbergson/archive/2013/05/14/how-to-build-an-ad-replication-delay-lag-site.aspx
You will want to create yourself a group policy that prevents the DC in the DR site from registering records that will advertise itself as an authenticating DC.  If you need to use the DR site, you will need to remove the gpo and either reboot the DC
or run a gpupdate and restart NetLogon on the DC so it will register the records so the clients can then use this DC.
Paul Bergson
MVP - Directory Services
MCITP: Enterprise Administrator
MCTS, MCT, MCSE, MCSA, Security, BS CSci
2012, 2008, Vista, 2003, 2000 (Early Achiever), NT4
Twitter @pbbergs http://blogs.dirteam.com/blogs/paulbergson
Please no e-mails, any questions should be posted in the NewsGroup.
This posting is provided AS IS with no warranties, and confers no rights.