Adding a second Domain Controller

...ok, so what you're saying is, If I don't spread out the FSMO roles, when the primary DC fails, I will likely run into problems until I seize the FSMO roles and delegate them to the secondary DC? By spreading out the FSMO roles, I am creating less work for myself in the event of a failure?
...Having said that, it isn't critical that I spread out the FSMO roles, but, would benefit me in the event of failure from a time stand point?

I'm sitting at about 95% completion... but before I click finish, I had a few questions...
I have a physical domain controller and Site-A, I want to add a secondary Domain Controller to Site-A and run it as a Virtual Machine... just in case the first DC dies, my users can still authenticate while I restore it from backup...
I'm essentially adding a new DC to the existing domain, Global Catalog, DNS... not read only...
I don't understand FSMO... do I need to do anything? or can I literally just add the second DC to the existing domain, enter the IP of the new DC in the secondary DNS on all my workstations (or DHCP leases settings) and call it a day?
Thanks for the input.. .just trying to make sure I'm not going to hose my primary DC or fek something up and create more work for myself than necessary...
This topic first appeared in the Spiceworks Community

Similar Messages

Adding a second domain controller to domain

Neally I can do that no problem but why it is asking me again when it was already done when I added my first 2008 R2 Domain Controller . I will try running it again and post the results.
Thanks

Hi ,
I am trying to add a second Windows 2008 R2 domain controller to a existing domain.
but its asking me to run adprep/forestprep but I already have domain controller that is a Windows Server 2008 R2 and it is also a Schema Master Role holder .
Any help is this regards will be much appreciated.
Thanks
Sunny Boparai
This topic first appeared in the Spiceworks Community

Adding second domain controller in Windows server 2012 R2

Hello, our primary domain controller is currently on a machine that has Windows Server 2008 R2 Standard. We are planning to setup a second domain controller as a failover to our primary domain controller. My question is, can we have a secondary domain
controller on a Windows Server 2012 R2 even if our primary domain controller is on a machine that has Windows Server 2008 R2?

I think I found the answer to my question.
http://technet.microsoft.com/en-us/library/dd464018(v=ws.10).aspx
"In Windows Server 2012, Adprep.exe is integrated into the AD DS installation process and runs automatically as needed. For example, when you install the first domain controller that runs Windows Server 2012 into an existing domain and forest, then adprep
/forestprep and adprep /domainprep automatically run and report the results of the operations.
Some organizations may prefer to run Adprep.exe separately in advance of an AD DS installation. For this reason, Adprep.exe is also included in the \Support\Adprep folder of the operating system disk.
In Windows Server 2012, there is only one 64-bit version of Adprep.exe. It can be run remotely from any server that runs a 64-bit version of Windows Server 2008, Windows Server 2008 R2, or Windows Server 2012. The computer where you run it can be either
domain-joined or in a workgroup.
The version of Adprep.exe in Windows Server 2012 includes new syntax and parameter options in order to run it remotely. For more information, see
Adprep."
For more information about the objects and containers that are created when the schema is extended to support Windows Server 2012, see
Windows Server 2012: Changes to Adprep.exe.

Potential Downtime or Damage to Exchange if I remove a second domain controller??

We have a single instance of Exchange 2010 with all roles (minus lync, communications, etc..) on a Server 2008 Standard server.
We also have a primary domain controller and a second domain controller that offers DNS and would be used in case of disaster to the primary controller.
I've noticed in the past that if the secondary domain controller is down for maintenance that the Exchange server starts having problems. A major example of this would be last year the virtual instance of the second domain controller failed and when we rebooted
the exchange server, it lost its association with the domain even though the primary domain controller was readily accessible.
We are in a spot now that we no longer need the secondary domain controller and want to decommission it. I obviously want that to go as smoothly as possible. Is there anything I should do to prevent any unwanted damages to the exchange environment?
Jonathan Strader

It doesn't seem that anyone has responded to this. The short answer is turning off the secondary server will NOT have an effect on the exchange server. HOWEVER, that is the short answer.
It WILL have an effect if:
1) the secondary server is the ONLY DNS server and the exchange server is using the secondary server for DNS queries.
2) The FSMO Roles are on the secondary server
3) The Secondary server is the only global catalog.
I know this is a lot to take in.. but it really isn't that hard. FSMO Roles and global catalog are just a piece of active directory that keeps track of users, rights, settings, that sort of thing. You need to make sure that you seize the FSMO
roles on the first domain controller.
One command you can do on the first server to check fsmo roles is:
netdom query fsmo
On a side note. This is what you can do as well to see if the secondary server has any effect on exchange. Ready? Turn off the secondary server and see if anything bad happens (People don't get their emails..) if something stops working
after you turn off the second server then turn it back again. Everything should be back to normal.
Jerry Suner

Remove a domain controller

I have SBS 2008 with a Windows Server 2008 SP2 server as a second domain controller. I've added a new 2012 server and made it a domain controller. I need to demote the 2008 box. If I run dcpromo, it doesn't detect that it is a domain
controller and just wants to create a new one. I notice that the AD DS service is not running, it is disabled. When I try to start it, it just stops. dsquery server shows all three as domain controllers. What is the best way to remove
this DC?

I have gone through the thread. Please check the following:
1. Login to 2012 DC, and check "NTDS Settings" are not seen under 2008 DC in Active Directory Sites and Services snap-in
2. Ensure that 2012 DC have all FSMO roles
3. Do your clients point to 2008 DNS for resolution or 2012 DC for resolution? If they use 2008, plan to change them to 2012
4. Ensure that 2008 DC doesn't run any other services like - WINS, DFS, DHCP, Certificate Services etc.
5. Run repadmin /replsummary to see replication state for 2008 DC
Once the above are answered, I would suggest that you clean-up the Active Directory metadata by using NTDSUTIL on 2012 DC.
If there are any configuration issues with 2008 DC and it is not completely removed from the configuration then you could end up with having Lingering Objects in your environment and it might create more issues.
I suggest to clean-up AD before Tombstone period kicks in for 2008DC.
- Sarvesh Goel - Enterprise Messaging Administrator

New Domain Controller does not show in our different site's Domain controller's Sites and Services

Hi,
we have two sites in our AD environment. OMA site and NY site. we have three domain controllers in our OMA site and two domain controllers in our NY site. All our DCs are windows server 2008R2 except one in our OMA site that is 2003R2 the domain
functional level is also 2003R2.
We decided to raise our functional level to 2008R2. I added a new domain controller in our OMA site and transferred all FESMOS from the DC that was running 2003R2 to this new domain controller.
the issue now is that our NY site does not make any connection with the new domain controller in OMA site. it does not even show it under sites and services. I have checked the DNS settings and everything. if you try to replicate the connections
from NY site it gives the following error: "The naming context is in the process of being removed or is not replicated from the specific server."
can anyone plz tell me why this is happening mt brain is just frozen at this moment and cant figure out why is this happening

Just noticed this replication issue has been going on for a while now but we never noticed until I added new DC. here is the error log for the NY site DC.
Log Name:      Directory Service
Source:        Microsoft-Windows-ActiveDirectory_DomainService
Date:          1/4/2014 8:11:40 AM
Event ID:      2042
Task Category: Replication
Level:         Error
Keywords:      Classic
User:          ANONYMOUS LOGON
Computer:      NORDC1.vertrue.com
Description:
It has been too long since this machine last replicated with the named source machine. The time between replications with this source has exceeded the tombstone lifetime. Replication has been stopped with this source.
The reason that replication is not allowed to continue is that the two DCs may contain lingering objects. Objects that have been deleted and garbage collected from an Active Directory Domain Services partition but still exist in the writable partitions
of other DCs in the same domain, or read-only partitions of global catalog servers in other domains in the forest are known as "lingering objects". If the local destination DC was allowed to replicate with the source DC, these potential lingering object
would be recreated in the local Active Directory Domain Services database.
Time of last successful replication:
2013-05-16 15:26:38
Invocation ID of source directory server:
9236ac56-d046-4632-b072-acbe823c5f6c
Name of source directory server:
accde843-11b2-476c-9783-9b29252d0ba5._msdcs.vertrue.com
Tombstone lifetime (days):
90
The replication operation has failed.
User Action:
The action plan to recover from this error can be found at
http://support.microsoft.com/?id=314282.
If both the source and destination DCs are Windows Server 2003 DCs, then install the support tools included on the installation CD. To see which objects would be deleted without actually performing the deletion run "repadmin /removelingeringobjects
<Source DC> <Destination DC DSA GUID> <NC> /ADVISORY_MODE". The eventlogs on the source DC will enumerate all lingering objects. To remove lingering objects from a source domain controller run "repadmin /removelingeringobjects <Source
DC> <Destination DC DSA GUID> <NC>".
If either source or destination DC is a Windows 2000 Server DC, then more information on how to remove lingering objects on the source DC can be found at
http://support.microsoft.com/?id=314282 or from your Microsoft support personnel.
If you need Active Directory Domain Services replication to function immediately at all costs and don't have time to remove lingering objects, enable replication by setting the following registry key to a non-zero value:
Registry Key:
HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Allow Replication With Divergent and Corrupt Partner
Replication errors between DCs sharing a common partition can prevent user and compter acounts, trust relationships, their passwords, security groups, security group memberships and other Active Directory Domain Services configuration data to vary between
DCs, affecting the ability to log on, find objects of interest and perform other critical operations. These inconsistencies are resolved once replication errors are resolved. DCs that fail to inbound replicate deleted objects within tombstone lifetime
number of days will remain inconsistent until lingering objects are manually removed by an administrator from each local DC. Additionally, replication may continue to be blocked after this registry key is set, depending on whether lingering objects are
located immediately.
Alternate User Action:
Force demote or reinstall the DC(s) that were disconnected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-ActiveDirectory_DomainService" Guid="{0e8478c5-3605-4e8c-8497-1e730c959516}" EventSourceName="NTDS Replication" />
    <EventID Qualifiers="49152">2042</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>5</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2014-01-04T13:11:40.963263500Z" />
    <EventRecordID>38018</EventRecordID>
    <Correlation />
    <Execution ProcessID="660" ThreadID="1596" />
    <Channel>Directory Service</Channel>
    <Computer>NORDC1.vertrue.com</Computer>
    <Security UserID="S-1-5-7" />
</System>
<EventData>
    <Data>2013-05-16 15:26:38</Data>
    <Data>9236ac56-d046-4632-b072-acbe823c5f6c</Data>
    <Data>accde843-11b2-476c-9783-9b29252d0ba5._msdcs.vertrue.com</Data>
    <Data>90</Data>
    <Data>Allow Replication With Divergent and Corrupt Partner</Data>
    <Data>System\CurrentControlSet\Services\NTDS\Parameters</Data>
</EventData>
</Event>

Old domain controller crashed. Created a new one..having to rejoin computers to domain..easier way to do this?

I had a single domain controller. It has crashed. I had to create a new domain controller with all the same existing information from the old server..same domain name, server name, and IP. Im having issues with desktops. Everything is setup on the server.
The desktops however I need to rejoin them to the domain and get them to start synching properly. But when I do this, the profile is resetting itself to a new profile. How can I keep the same profile with the same documents. Or am I out of luck on this and
have to recreate the profiles. I have had to recreate the profiles so far, but do not want to do this for about 5 computers because there is way to much software and work that will need to be involved in moving these profiles. Any shortcut for these computers
to automatically see this domain server and synch to it? Everything is identical to the old server. The old server is inaccessible.
The new servers domain name is the same, IP address is the same, and computer name is the same. AD running with all identical information. DNS installed.
Let me know if anyone has some advice on here.

There's unfortunately a lot more involved than names, domain names and IP addresses.
Most of those are linked to long numbers such as "SID"s and "GUID"s in the background that actually govern the interaction between clients and servers (authentication for one).
Without the same SIDs and GUID, I fear there will be no end to your problems.
That's why either a second domain controller or a good backup are so important.
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you.

Secondary Domain Controller Not Authenticating Domain Users

Hi.
I have a primary domain controller running Win Srv 2012 in USA and i added a secondary domain controller 2012 in the same domain from a different location India, through VPN.so that India user accounts can authenticate by the secondary DC instead of primary
DC USA
Installation & replication of AD went fine
India domain users login is damn slow.
When i ran the command echo %logonserver% from a india client machine,it displays the USA Primary DC name which means its authenticating the users from USA primary DC.
Preferred DNS for india client machine is Secondary DC IP and alternate is Primary DC IP USA.
Please find the dcdiag results below and any help much appreciated
Performing initial setup:
Trying to find home server...
Home Server = server2
* Identified AD Forest.
Done gathering initial info.
Doing initial required tests
Testing server: INDIA\server2
Starting test: Connectivity
......................... server2 passed test Connectivity
Doing primary tests
Testing server: INDIA\server2
Starting test: Advertising
Warning: DsGetDcName returned information for \\server1.tst.mycompany.com, when we were trying to reach
server2.
SERVER IS NOT RESPONDING or IS NOT CONSIDERED SUITABLE.
......................... server2 failed test Advertising
Starting test: FrsEvent
......................... server2 passed test FrsEvent
Starting test: DFSREvent
There are warning or error events within the last 24 hours after th
replication problems may cause Group Policy problems.
......................... server2 failed test DFSREvent
Starting test: SysVolCheck
......................... server2 passed test SysVolCheck
Starting test: KccEvent
......................... server2 passed test KccEvent
Starting test: KnowsOfRoleHolders
......................... server2 passed test KnowsOfRoleHolders
Starting test: MachineAccount
......................... server2 passed test MachineAccount
Starting test: NCSecDesc
......................... server2 passed test NCSecDesc
Starting test: NetLogons
Unable to connect to the NETLOGON share! (\\server2\netlogon)
[server2] An net use or LsaPolicy operation failed with error 67,
......................... server2 failed test NetLogons
Starting test: ObjectsReplicated
......................... server2 passed test ObjectsReplicated
Starting test: Replications
......................... server2 passed test Replications
Starting test: RidManager
......................... server2 passed test RidManager
Starting test: Services
......................... server2 passed test Services
Starting test: SystemLog
A warning event occurred. EventID: 0xA004001B
Time Generated: 02/22/2015 17:10:30
Event String: Intel(R) 82574L Gigabit Network Connection
A warning event occurred. EventID: 0x000727A5
Time Generated: 02/22/2015 17:11:24
Event String: The WinRM service is not listening for WS-Manageme
An error event occurred. EventID: 0x0000271A
Time Generated: 02/22/2015 17:11:24
Event String:
The server {9BA05972-F6A8-11CF-A442-00A0C90A8F39} did not regist
A warning event occurred. EventID: 0xA004001B
Time Generated: 02/22/2015 17:12:41
Event String: Intel(R) 82574L Gigabit Network Connection
A warning event occurred. EventID: 0x000003F6
Time Generated: 02/22/2015 17:19:36
Event String:
Name resolution for the name mycompany.com timed out after none
A warning event occurred. EventID: 0x00001796
Time Generated: 02/22/2015 17:28:54
Event String:
Microsoft Windows Server has detected that NTLM authentication i
his server. This event occurs once per boot of the server on the first time
A warning event occurred. EventID: 0x000727A5
Time Generated: 02/22/2015 17:33:35
Event String: The WinRM service is not listening for WS-Manageme
A warning event occurred. EventID: 0x00001796
Time Generated: 02/22/2015 17:35:54
Event String:
Microsoft Windows Server has detected that NTLM authentication i
his server. This event occurs once per boot of the server on the first time
......................... server2 failed test SystemLog
Starting test: VerifyReferences
......................... server2 passed test VerifyReferences
Running partition tests on : ForestDnsZones
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... ForestDnsZones passed test CrossRefValida
Running partition tests on : DomainDnsZones
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... DomainDnsZones passed test CrossRefValida
Running partition tests on : Schema
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Running partition tests on : Configuration
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Configuration passed test CrossRefValidat
Running partition tests on : tst
Starting test: CheckSDRefDom
......................... tst passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... tst passed test CrossRefValidation
Running enterprise tests on : tst.mycompany.com
Starting test: LocatorCheck
......................... tst.mycompany.com passed test LocatorChec
Starting test: Intersite
......................... tst.mycompany.com passed test Intersite

Hi.
I have a primary domain controller running Win Srv 2012 in USA and i added a secondary domain controller 2012 in the same domain from a different location India, through VPN.so that India user accounts can authenticate by the secondary DC instead of primary
DC USA
Installation & replication of AD went fine
India domain users login is damn slow.
When i ran the command echo %logonserver% from a india client machine,it displays the USA Primary DC name which means its authenticating the users from USA primary DC.
Preferred DNS for india client machine is Secondary DC IP and alternate is Primary DC IP USA.
Firstly make sure that you have configured sites and subnets correctly. According to your information which you have two locations, you should have at least 2 sites and 2 subnets associated to them. If you have forgotten to configure subnets of India in your
site and services and assigned them to the India site you are experiencing this issue. Also make sure if clients in India has appropriate network connectivity to the domain controllers in India.
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

Server 2012 Secondary Domain Controller not picking up AD nor DNS responsibilities

I had a single Domain Controller providing AD, DNS and DHCP. I went through the steps to add a Secondary Domain Controller. All the AD and DNS info shows up in the Secondary Server, however, when my original Domain Controller is turned
off, the second Domain Controller is not taking over for AD and DNS.

Hi Bayousmurf,
Good that you made some progress. However, can you please provide us the information on how you acheived transfering FSMO role to another DC since you had some issue earlier?
Your initial intention was to demote the original DC. Please follow the below link for the steps to demote the DC.
http://technet.microsoft.com/en-in/library/jj574104.aspx
Still if I power off the original DC the new one isn't taking up DNS. Still looking into the DNS...
Can you please elaborate what exactly you are looking for? When you power off original DC, you don't see DNS in new DC? Is your DNS active directory integrated? If not please follow the below procedure to make it as a AD integrated. Once done, then, power
off original DC and look in new DC to see if DNS shows up.
http://www.tomshardware.com/faq/id-1954324/configure-active-directory-integrated-dns-zone-windows-server-2012-dns-server.html
Thanks,
Umesh.S.K

Group Policy Management Console Failes to open when one Domain Controller is powered down

Hi All,
This was an accidental discovery, but here's my dilemma. I have a site with 2 domain controllers(Windows 2008 R2), and if I shut down my second domain controller, when I try to open the Group Policy Management Console on the 1st domain controller,
it fails to open and I get the following error, "The specified domain either does not exist or could not be contacted" with 3 options to "retry", "choose another domain controller", or remove. If I go to chose another domain
controller and select the 1st domain controller it still fails. Unless the 2nd DC is turned on, I have no issues opening the GP management console. Not sure, why this is happening, I've done it in the pass without issue.
Any help would be appreciated.
Thanks

Well it seems that some how the PDC emulator is set to be the 2nd DC instead of the 1st DC on the 1st DC which explains why the failure after the 2nd DC went down. Why or should I say how could the PDC get switched from the primary DC without human intervention.
Does the PDC automatically switch for any reason?

Question about adding Windows 2012 R2 Domain Controller, into a native Windows 2008 R2 single forest domain

I current have a two server domain, both Windows 2008 R2 and fully updated. The two servers are on subnet 10.0.1.0 /24
- Windows 2008 R2 Server A: 10.0.1.1 (DC, GC, FSMO, DNS)
- Windows 2008 R2 Server B: 10.0.1.2 (DC, GC)
AD Domain: COMPANY.LOCAL
I have a second connected subnet, 192.168.1.0 /24) which is routed to the 10.0.1.0/24 subnet and I would like to install a Windows 2012 R2 server onto a server on that subnet and make it a domain controller with AD-Integrated DNS and DHCP for the 192.168.1.0
/24 subnet.
- Windows 2012 R2 Server C: 192.168.1.1
What are the proper progression steps, in order to bring up the Windows 2012 R2 server and then add it to my COMPANY.LOCAL domain and then promote it do a DC/GC/AD-Integrated DNS server? Are they anything like the following:
1. Install Windows 2012 R2 server (Server C)
2. Point Windows 2012 R2 server DNS servers at Server's A and B
3. Perform AD prep to extend AD schema to support Windows 2012 R2 domain controllers
4. Promote Windows 2012 R2 server to domain controller (install local DNS service on Server C, during this step)
* Question: Will Windows automatically create a DNS zone for the Windows 2012 R2 subnet (192.168.1.0/24) AND also include the DNS zone from the previous Windows 2008 R2 domain (10.0.1.0 /24)? Or will I need to add the 10.0.1.0 /24 zone to the DNS
server on Server C, even though the DNS from the Windows 2008 R2 domain is AD integrated?

Hi,
Regarding the issue here, please take a look into below articles:
System Requirements and Installation Information for Windows Server 2012 R2
http://technet.microsoft.com/en-us/library/dn303418.aspx
Release Notes: Important Issues in Windows Server 2012 R2
http://technet.microsoft.com/en-us/library/dn387077.aspx
Install a Replica Windows Server 2012 Domain Controller in an Existing Domain (Level 200)
http://technet.microsoft.com/en-us/library/jj574134.aspx
Here is an example for promoting Windows Server 2012 to a DC, see:
Step-by-Step Guide for Setting Up A Windows Server 2012 Domain Controller
http://social.technet.microsoft.com/wiki/contents/articles/12370.step-by-step-guide-for-setting-up-a-windows-server-2012-domain-controller.aspx
As the server is promoted to a DC, DNS Zones will be replicated and synchronized to it automatically whenever the new one is added to an AD DS domain, bascially there is no special need to add zones, for more information, please see:
Understanding Active Directory Domain Services Integration
http://technet.microsoft.com/en-us/library/cc726034.aspx
Hope this may help
Best regards
Michael
If you have any feedback on our support, please click
here.
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Adding a domain controller to an existing Domain inside server 2012

I have created a domain contoso.com with an administrator account.Then i moved to 2nd server which i want to add in this existing domain.Being logged in at the 2nd server with administrator account, i added the role of ADDS and then i tried to promote
this to DC.While do so, i selected the option "Add a domain controller to existing domain".When i finally recah this the Installation wizard , it shows like "creating NDTS settings objects fo this ADDS on remote ADDC(domain name)..........This
page remains in progress for ages and process never finishes.
When i check at the first(main domain) , there is no NDTS object for the added DC although i can see the server but nothing inside it.NDTS object should be there.Y
1) NDTS object is not created ?
2) The process is taking hours?
Both can ping each other
Regards,
Fawad

1. IP of DNS setting on second server points to first DC.
2. Add second computer to domain. Make sure that second server is part of AD (member).
3. Add role ADDS on second server that is member of AD.
In summary: You should add second server to domain first before promoting it to DC role.
Regards
Milos

Adding a Server 2008 R2 Domain Controller at a remote site

Hello. I have been trying to set up a hot site at a remote location. The story is long and involved but a few weeks ago it seemed to be finally working. Our setup is two mirrored 2008 R2 servers at main site, mirrored with Double Take.
The hot site is the same except that so far I only had one server working. The two sites connected via site to site VPN.
About a week later our primary server basically crashed. At first it worked but very slowly. I was on vacation at the time and so I am not sure of the sequence of events, or exactly what errors were presented, but my associate first tried rebooting.
It took over 20 minutes to boot and then it said something to the effect that no domain controllers were available (not sure about this message). He then discovered that the server at the remote site had some fsmo roles assigned to it. He transferred
the roles to the primary at the main site and then demoted the remote server to a workstation (but still a domain member).
After that, rebooting the primary was much faster and everything at the primary site is working again. Now I want to set the remote site up again, but avoid the problem. The way I originally set up the remote server was to use an IFM file, generated
from our primary. This should have made the remote server a catalog server, with DNS (which it did), but as far as I know should not have transferred any fsmo roles.
The remote server(s) are wanted to be in the same domain as the primary. They will also be mirrored from the primary (with Double Take). If we had total failure at the main site, we wish to be able to immediately begin operations at the hot site
(after a fail over). I freely admit that I am swimming out of my depth here. I am not sure that I have selected the correct architecture or used the correct options in setting up the remote servers. I am looking for information about what
went wrong, and whether some other setup is more desirable.
Thanks for any help, Russ
Russ

Philippe, thank you for you answers. I do not understand everything you said but I will address each point as best I can:
1. "In the remote site do you simply do a dcpromo / add the ADDS's role to make the server a active Domain Controller ?" Yes, but I use the method described at
http://technet.microsoft.com/en-us/library/cc753720(v=ws.10).aspx, The GUI method. At step #8 I specified to use advanced mode so I could use the IFM file.
2. "In your AD' Site and Service MMC, do you configured the remote site ?" R do not know what you mean by this. How does one configure the site as 'remote'?
3. "Do you added that remote server as a Global catalogue ?". Yes, when I built the IFM file I specified to add the global catalog.
4. "Do you added the PC in site 1, the IP of those DNS server in them ? (last of course) So the computer in the main site will talk to the remote server in case of a crash." I am not sure I understand this item. After the remote server
was added, all of the members of both domain servers automatically appeared in the DNS of all servers in the domain. I do not recall if the new items were last, but I expect that they would be.
I have since reviewed the happenings with my associate and have a little more information. The order of the problems and the actions taken are:
1. Our primary (production) system was still working but extremely slow, and he observed that the slowness was caused by a lot of traffic with the remote site. Rebooting the production server took over 25 minutes and the server to came up saying
that domain information was not available. After another 30 minutes or so he discovered that the domain data was now available and the server worked, but still slow.
2. He did not check to verify that roles were held by the remote server, but he transferred all roles from the remote to the production server using ntdsutil. I would expect that if the role was not held by the remote, the transfer command would have
shown that fact.
3. He then tried to demote the remote server but had an error that it could not be demoted because "the active directory service is missing mandatory configuration information".
4. He forcefully demoted the remote server.
5. After rebooting the production server again performance was slightly better but still slow (and the rebood was still very slow).
6. After some research he removed the remote domain controller's meta data from the production server and then rebooted the production server again.
At that point reboot was fast (under 5 minutes) and the production system was working at normal speed again.
All of the above leads me to believe that somehow the FSMO roles got added to, or moved to the remote site when I used the IFM file to create the new domain controller. However nothing I have read says that this should happen. I hope someone
here can give me a better answer as to what caused the problem, as I do not wish to interrupt our production system like this again.
Thank you, Russ
PS: Sorry for the delay in getting back to this but some other priorities took me away from it for a week.
Russ

Adding third domain controller - decommissioning one existing

Hello,
I would like to add a new 2012 domain controller to site A which already has a 2008 domain controller. There is also another site B with has an existing 2012 domain controller. I have a couple questions.
When I add the new domain controller to site A do I point the DNS controller to the existing domain controller in site A before promoting(that is by far the fastest link)?
When I am done adding domain controller at site A and go to decommission the existing 2008 domain controller what DNS do I point to on the new domain controller and how do I do this? Do I just put site B domain controller's\DNS IP address as the preferred
and reboot the new domain controller and do the same on site B domain controller to point it's primary DNS to the new one?
Thanks

When I add the new domain controller to site A do I point the DNS controller to the existing domain
controller in site A before promoting(that is by far the fastest link)?
Yes. After promoting it, you can refer to my recommendations about IP settings for DCs: http://www.ahmedmalek.com/web/fr/articles.asp?artid=23
When I am done adding domain controller at site A and go to decommission the existing 2008 domain
controller what DNS do I point to on the new domain controller and how do I do this? Do I just put site B domain controller's\DNS IP address as the preferred and reboot the new domain controller and do the same on site B domain controller to
point it's primary DNS to the new one?
Refer to my recommendations for IP settings.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Questions About Adding First 2012 R2 domain controller to an existing 2008 Domain

Our current domain controllers are all running Server 2008 and are VMs in our local office. We plan to add a new domain controller and also create a new AD site. This new domain controller will be the only domain controller in the new remote
site. It will also be a VM on a new 2012 R2 Hyper-V server at the new remote site.
There is currently only one site (the default first site).
The steps planned are to create a new site to represent the remote location in AD configured with the subnets that apply to the remote site. (Computers in our local office should continue to use the domain controllers in our office and remote PCs should
start using the new domain controller.)
Then build the new domain controller VM, join to the domain as a member server and then promote it to domain controller of the new site.
Are any steps missing?
Do we need to do anything special with time sync settings on Hyper-V or will both the Hyper-V host and the domain controller guest just automatically sync time with the PDC domain controller across a WAN connection at the main site?
Is there a way to prepare the domain/schema for the new 2012 R2 domain controller in advance so that the new domain controller can be installed later without needing Schema Admin or Enterprise admin permissions during the installation?

> Where can I find what is correct for 2012 R2 domain controllers running
> on Hyper-V 2012 R2 hosts?
There's no "one fits all" advice on this topic, but I agree with Ahmed:
Within a domain, the DCs provide a hierarchical time source, and since
clients are required to be in sync with DCs, this is a "must be".
If your HV hosts are member of the domain they are hosting, things can
easily go crazy if you do not disable host time sync.
Greetings/Grüße,
Martin
Mal ein
gutes Buch über GPOs lesen?
Good or bad GPOs? - my blog…
And if IT bothers me -
coke bottle design refreshment (-:

Adding a second Domain Controller

Similar Messages

Maybe you are looking for