Additional domain controller

hi , we r using win2008 r2 and recently we have created additional domain controller on another server in the same forest can we install sql server 2008 same as on our main domain controller pls advivice its urgent
thanks
ganesh

Please see http://support.microsoft.com/kb/2032911/no
Regards,
Thomas

Similar Messages

Error while configuring ADC (Additional Domain Controller)

Hello Experts,
I am configuring ADC (Additional Domain controller) in a member server which is in workgroup. while configuring ADC on that server, I got a window saying "additional information for this domain controller", where there were three options, i.e.
DNS server, Global Catalog, RODC (Read only Domain controller) and bydefault first two options(DNS & Global Catalog) were checked. I kept that setting and clicked on next. Now this is showing I need to give a static IP to my adapter, but I have already
given a static IP. when I unchecked the DNS button from that window it was not giving such error. Now my question is if I continue without checking the DNS, will it give me trouble in future. Please suggest. I am using MS2008 R2.
Swaprakash..

Ensure that you don't have another NIC in your server that is set to obtain IP address from DHCP. However, even if you proceed with this warning, you will probably not have any errors later, as long as you're sure that you have static IP assigned to your
internal NIC.
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Damir

What is the best practice and Microsoft best recommended procedure of placing "FSMO Roles on Primary Domain Controller (PDC) and Additional Domain Controller (ADC)"??

Hi,
I have Windows Server 2008 Enterprise and have
2 Domain Controllers in my Company:
Primary Domain Controller (PDC)
Additional Domain Controller (ADC)
My (PDC) was down due to Hardware failure, but somehow I got a chance to get it up and transferred
(5) FSMO Roles from (PDC) to (ADC).
Now my (PDC) is rectified and UP with same configurations and settings. (I did not install new OS or Domain Controller in existing PDC Server).
Finally I want it to move back the (FSMO Roles) from
(ADC) to (PDC) to get UP and operational my (PDC) as Primary.
(Before Disaster my PDC had 5 FSMO Roles).
Here I want to know the best practice and Microsoft best recommended procedure for the placement of “FSMO Roles both on (PDC) and (ADC)” ?
In case if Primary (DC) fails then automatically other Additional (DC) should take care without any problem in live environment.
Example like (FSMO Roles Distribution between both Servers) should be……. ???
Primary Domain Controller (PDC) Should contains:????
Schema Master
Domain Naming Master
Additional Domain Controller (ADC) Should contains:????
RID
PDC Emulator
Infrastructure Master
Please let me know the best practice and Microsoft best recommended procedure for the placement of “FSMO Roles.
I will be waiting for your valuable comments.
Regards,
Muhammad Daud

Here I want to know the best practice
and Microsoft best recommended procedure for the placement of “FSMO Roles both on (PDC) and (ADC)” ?
There is a good article I would like to share with you:http://oreilly.com/pub/a/windows/2004/06/15/fsmo.html
For me, I do not really see a need to have FSMO roles on multiple servers in your case. I would recommend making it simple and have a single DC holding all the FSMO roles.
In case if
Primary (DC) fails then automatically other Additional (DC) should take care without any problem in live environment.
No. This is not true. Each FSMO role is unique and if a DC fails, FSMO roles will not be automatically transferred.
There is two approaches that can be followed when an FSMO roles holder is down:
If the DC can be recovered quickly then I would recommend taking no action
If the DC will be down for a long time or cannot be recovered then I would recommend that you size FSMO roles and do a metadata cleanup
Attention! For (2) the old FSMO holder should never be up and online again if the FSMO roles were sized. Otherwise, your AD may be facing huge impacts and side effects.
This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Get Active Directory User Last Logon
Create an Active Directory test domain similar to the production one
Management of test accounts in an Active Directory production domain - Part I
Management of test accounts in an Active Directory production domain - Part II
Management of test accounts in an Active Directory production domain - Part III
Reset Active Directory user password

Can we run domain controller windows 2008 32 bit and additional domain controller on 2003 server

im my environment we are trying to upgrade from server 2k3 to 2k8, out testing done on server 2k3 to 2k8, but can we run domain controller windows 2008 32 bit and additional domain controller on 2003 server ...kindly suggest
Nitin Gaurav
[email protected]

Yes you can. If you have two 2003 AD servers currently and upgrade one of them to 2008 AD then they'll continue to be able to work together. The domains functional level will remain as 2003 across both servers so at this stage you won't get any benefit from
the new AD functionality available in 2008.
Once you've then upgraded the second 2003 server to 2008 you can then upgrade the functionality levels in AD to make it 2008. It's been a while, but I believe it doesn't happen automatically, so once all AD servers have been upgraded you have to go into
AD and upgrade the functionality levels yourself.

Ports for Creating Additional Domain controller at my remote DRC site

Hello Expert,
I have my disaster recovery center (DRC) at a remote place, now I want to configure Additional domain controller (ADC) at my DRC, kindly share me the list of ports that I need to open at my firewall to configure this ADC. I am having Server 2008R2 environment.
Swaprakash..

Hi,
The blelow link has a detailed information of the required port should be open for AD communication
Active Directory Firewall Ports - Let's Try To Make This Simple
http://msmvps.com/blogs/acefekay/archive/2011/11/01/active-directory-firewall-ports-let-s-try-to-make-this-simple.aspx
http://technet.microsoft.com/en-us/library/dd772723(WS.10).aspx
http://social.technet.microsoft.com/wiki/contents/articles/584.active-directory-replication-over-firewalls.aspx
Regards,
Rafic
If you found this post helpful, please give it a "Helpful" vote.
If it answered your question, remember to mark it as an "Answer".
This posting is provided "AS IS" with no warranties and confers no rights! Always test ANY suggestion in a test environment before implementing!

Unable to complete Additional domain controller installation

HI Team,
I have a Lab setup having 3 domain controllers. Initially I promoted a Domain Controller on 2008 server. After that I promoted another 2008 server as additional domain controller. Everything was completed successfully . But when I tried a 2012 server
as additional controller , the installation was not getting completed. Actually process is stucked in installation Tab. Even I installed 2012 server newly and the issue is persist.
Can anyone suggest me to fix this issue ?
Do we need to migrate schema ?
Regards
Sajin P S

Hi Anuj,
I'm sure that its is some thing related to a network issue. Make sure that all the necessary ports are open between the domain controllers.
Active Directory and Active Directory Domain Services Port Requirements
http://technet.microsoft.com/en-us/library/dd772723(WS.10).aspx
Active Directory Firewall Ports - Let's Try To Make This Simple
http://msmvps.com/blogs/acefekay/archive/2011/11/01/active-directory-firewall-ports-let-s-try-to-make-this-simple.aspx
Use port query tool to see the opened ports.
http://social.technet.microsoft.com/wiki/contents/articles/4494.windows-server-troubleshooting-the-rpc-server-is-unavailable.aspx#Using_PortQry
Regards,
Rafic
If you found this post helpful, please give it a "Helpful" vote.
If it answered your question, remember to mark it as an "Answer".
This posting is provided "AS IS" with no warranties and confers no rights! Always test ANY suggestion in a test environment before implementing!

Installing Additional Domain Controller in different Network

Hi All,
We are planning to add ADC on existing domain but before start I want to confirm that can I install ADC on different network range as follows:
Windows Server 2008 Enterprise SP2 Platform
HODOMAIN.com IP is: 192.168.2.11
Branch network New ADC IP is: 192.168.1.11
we can ping both servers, so can I start the installation of ADC or do I need to prepare ADC on same DC network at Head Office and after installation, we can move the server to branch office and change the IP?
Thanks
Agha

No problem when doing that. Just you need to make sure that any system that will be pointing to this DC by IP for LDAP or DNS query is updated to have the new IP instead of the new one. As this is a new server, you can proceed directly.
This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Get Active Directory User Last Logon
Create an Active Directory test domain similar to the production one
Management of test accounts in an Active Directory production domain - Part I
Management of test accounts in an Active Directory production domain - Part II
Management of test accounts in an Active Directory production domain - Part III
Reset Active Directory user password

DFSR Replication Event ID 1202 The DFS Replication service failed to contact domain controller Additional Information: Error: 160 (One or more arguments are not correct.)

Hi,
hummmm...
The client had 1 Server with AD and All Apps, IIS, Terminal Servers (30 device Cal), File Server, SQL2008R2 on it
Task: Install new AD server promote it to DC, bring in 2nd server, Replicate the File Server (DFSR) on these 2 servers, and demote it to standard server.
1) Old AD with name "Server" with OS-2008R2 SP1 and is a DC.
2) Brought in a new server "PrimaryAD", Installed 2008R2, done DC Promo, and added it as Additional Domain controller
3) Transferred roles from old server "Server" to "PrimaryAD"
4) Brought in a new File Server replicating server "Backup-Server"
5) Copied all the data from Server to Backup-server as DFS initial file sync with robocopy
6) here the problem started, after the copy finished, next morning the "Server" server crashed.....
7) thank god the data was backed up on Backup-server. but we didnt get the time to Demote the server "Server" and remove AD from it.
8) Since AD was replicated so "PrimaryAD" was are DC, brought 2nd Server "SecondaryDC" as additional domain controller.
9) we cleaned up the metadata and used ASIEDIT to clean the remaining stuff.
10) the "Server" server was formatted and renamed as "Primary-Server" and OS2008R2 SP1 was installed with rest of required apps
11) so now the PrimaryAD the DC, SecondaryAD the Additional Domain controller, Primary-Server the mail server and File server, the Backup-server, the replicated server.
Now configured DFS Replication from Primary-Server to Backup-server and receive following Event ID 1202
If i Configure DFS Replication as follows
PrimaryAD <<>> SecondaryAD -= Works... no errors...
PrimaryAD <<>> Backup-Server = Creates but Dosent works Event ID 5012, error The DFS Replication service failed to communicate with partner BACKUP-SERVER, Additional Information: Error: 9026 (The connection is invalid)
PrimaryAD <<>> Primary-Server = Dosent creates replication job just hangs,
on primaryad continious Eveni ID 10009, DCOM was unable to communicate with the computer "SERVER" using any of the configured protocols
......something on PrimaryAD is still trying to connect to old corrupt AD server "Server"
No errors with AD replication, SYSVOL & Netlogon shares also working fine and accessible.
DFS Diagnose report says
DNS name: backup-server.mydomain.com
Domain name: mydomain.COM
Reference domain controller: -- (HERE there is NO DOMAIN CONTROLLER mentioned)
IP address: 192.168.1.248,192.168.1.251,::1
Site: Default-First-Site-Name
Forgot to mention, gave full rights with ADSIEDIT to DFSR-LocalSettings for all server to Administrator and read permissions to "Authenticated Users"
DFSRDIAG POLLAD throws following error
c:\Dfsrdiag pollad /verbose
[INFO] Computer Name: BACKUP-SERVER
[INFO] Computer DNS: Backup-Server.mydomain.COM
[INFO] Domain Name: mydomain
[INFO] Domain DNS: mydomain.COM
[INFO] Site Name: Default-First-Site-Name
[INFO] Connected to WMI services on computer: Backup-Server.mydomain.COM
[INFO] Invoke PollDsNow() method on Backup-Server.mydomain.COM
[ERROR] PollDsNow method executed unsuccessfully. ReturnValue: 12 (0xc)
[ERROR] Failed to execute PollAD command Err: -2147217407 (0x80041001)
Can anyone point me to any direction which can lead to resolution of this ERROR and make DFS_R work..
Thanks
bikram

Hi,
It seems that DCPROMO did its work without complaints, still the DFSR references remained in AD. You could refer to the article below to clean up the DFS Replication object.
How to remove data in Active Directory after an unsuccessful domain controller demotion
http://support.microsoft.com/kb/216498
In additional, please refer to the following thread to troubleshoot the issue:
DFS is not working anymore.
http://social.technet.microsoft.com/Forums/windowsserver/en-US/953be9ef-e9e3-4885-a5c4-47fc475ba562/dfs-is-not-working-anymore?forum=winserverfiles
Regards,
Mandy
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Moving domain controller vm between Hyper-V 2012 R2 hosts

Hello,
I have one stand alone Hyper-V host - hvserver01 (Hyper-V Server 2012 R2) and 3 VM's running on it. One Virtual machine is our company's additional Domain controller.
I'm planning to install an additional hyper-v host - hvserver02 (Hyper-V Server 2012 R2) as well.
I have the following task to perform: I need to move domain controller virtual machine from hvserver01 to hvserver02.
So, for this operation which tool do i need - move, export/import or something else... ? or it will be necessary to install a new DC and then demote the old one.. ?
Is there a some special requirements when moving DC from one virtual host to another.. ?
And also, - MS Hyper-V Server 2012 R2 is installed on both Hyper-V hosts.
Do you have some advices ?
Thanks in advance,

There's no difference between a VM acting as your DC and any other VM as far as live-migration is concerned.
You should use live-migration. The VM will remain up and running during the entire process. Both Hyper-V hosts should be domain members. They should have vSwitches with the same exact name. They should have same CPU type, or configure CPU compatibility on
the VM. Configure Live-migration setting on each host. You can use Hyper-V Manager for live-migration..
Sam Boutros, Senior Consultant, Software Logic, KOP, PA http://superwidgets.wordpress.com (Please take a moment to Vote as Helpful and/or Mark as Answer, where applicable) _________________________________________________________________________________
Powershell: Learn it before it's an emergency http://technet.microsoft.com/en-us/scriptcenter/powershell.aspx http://technet.microsoft.com/en-us/scriptcenter/dd793612.aspx

Upgrading domain controller from Server 2003 to Server 2012 R2, how will this affect Exchange 2010?

Hi All,
Below is an AD and Server related post that I had submitted last week. While I did receive valid responses for the post, I was advised to check with the Exchange forums for the Exchange related question in
bold. All responses are welcomed, thank you!
===========================================================
Hi All,
I am hoping that someone could perhaps provide some insight on this topic as I apparently can't seem to google the best answer.
I have recently acquired an AD domain that is running on a 2003 domain controller. I have been tasked with upgrading our existing domain structure with 2012 R2 domain controllers for our main office and remote offices.
The domain name is company.mynetwork.com, and it is the default first site name. We have multiple offices throughout the US with their own domain controllers (i.e. FL.mynetwork.com, NY.mynetwork.com, DC.mynetwork.com, etc.).
Our main office, and default first site has one domain controller (mynetdc1) running Server 2003 R2. It is also our only DNS server for the main office. It also has an additional domain controller called mynetmaster3 which is running Server 2003.
Both mynetdc1 & mynetmaster3 NTDS settings show them as global catalogs under AD Sites & Services. Both servers are also in the AD Domain Controllers OU, along with all of the other satellite office domain controllers.
Additionally, our main office is running Exchange 2010 with the latest service pack. My questions are:
Can we demote and retire mynetmaster3, then replace mynetdc1 with a newly promoted 2012 R2 global catalog domain controller without harming anything in the domain tree and interrupting connectivity to the other offices (this of course goes without saying
after a 4 hour maintenance window to get the task completed has passed)?
Should we upgrade the satellite offices first after raising the functional level for mynetdc1, or should we do the opposite (upgrade main office, then satellite offices)?
MS Exchange 2010 is heavily dependent on AD, what effect will this entire project have on our email server? What steps should we take beforehand to ensure email continuity?
Finally, is there any shame for a Net Admin to suggest that we hire an implementation specialist for this task? :)
Any advice would be greatly appreciated!

As long as the operating system on your Exchange servers isn't upgraded, and as long as you do the Active Directory domain and forest updates in the supported manner (the following link is a good example -
http://blogs.msmvps.com/mweber/2012/07/30/upgrading-an-active-directory-domain-from-windows-server-2003-or-windows-server-2003-r2-to-windows-server-2012/), Exchange will happily operate behind the scenes. Exchange 2010 is supported in the Windows
forests (domain controllers, domain functional level and forest functional level) mentioned in the following TechNet article, which includes both Windows 2003 and Windows 2012.
http://technet.microsoft.com/en-us/library/ff728623(v=exchg.150).aspx
Due to this, you should be good as long as you do the domain controller, domain, and forest upgrades carefully. Oh, and before you start each step, get a nice backup.

Install Domain Controller, Active Directory, RemoteApps on Single Server?

Have a server that I want to experiment with RemoteApps. Documentation I have read state you need to have a Domain Controller setup with AD on one server, and have a second server to install all the RemoteApps requirements. Is this true or can
this all be done on one server.
If I need a separate server for the Domain Controller and Active Directory, can I assume that a low end server would be sufficient? Or would using Hyper-V with a single hardware server and create two virtual machines: one as the DC/AD, and the other
to run Remote Apps be a possible solution. Any advice?

it really depends to be honest. I'd probably go something like this though:
One Small physical server to act as a domain controller - you could put DHCP on this too
One or Two physical, quite powerful servers to act as Hyper-V hosts - these can be domain joined.
Then for your VM's create the following:
1 x additional domain controller
For remote desktop services:
1 x Remote Desktop Session Host
1 x Connection Broker
1 x Gateway and web server
For additional services
1 or 2 x Exchange
1 x sharepoint
1 x IIS
but it really depends what you want to achieve.
The benefit from Virtual machines is that you can keep separate virtual servers for separate applications.
If you have two hosts you could then replicate the virtual machines between them if you wanted some layer of fault tolerance.
Hope this helps you a bit more. And thanks for positive blog feedback - its appreciated.
Regards,
Denis Cooper
MCITP EA - MCT
Help keep the forums tidy, if this has helped please mark it as an answer
My Blog
LinkedIn:

Exchange server-Removing a Domain Controller from the forest

Hi Guys,
I need some help on removing a faulty domain controller from the AD forest. Here is the scenario:
1. The FSMO roles have been seized to a new domain controller already.
2. The old one is non-functional and is down for ever.
I know the steps would be doing a meta-data cleanup And then remove some of the DNS entries related to the old server. But the real issue is:
> I have Exchange 2013 running in one of the machines configured in the Forest, which was migrated from the old Domain controller. I then set Exchange listening to the new domain controller.
So, my doubt is, if I delete the old domain controller and do a metadata cleanup, would it have any effect on the exchange server? The Exchange machine acts as an additional domain controller as well. Its a production environment and any
change that affects Exchange would cause a big loss. Looking forward for your valuable suggestions..
Regards,
Nash

Hi Ed,
I don't have issues with the AD on the Exchange server. Eventhough it is configured as an AD, Exchange is pointed to the main working domain controller, which is a different machine. I just want to remove the traces of an old domain controller from which
I transferred the FSMO roles to the new domain controller. The old domain controller is completely down and hence I can't do a conventional 'dcpromo' on it. So just planning to do a 'metadata clean up' for removing the non-working DC from the forest.
So, In essence, I just want to know that, if I do a metadata cleanup, would it affect the Exchange server in any way?
Regards,
Nash

Upgrade a Domain Controller running Windows Server 2012 Datacenter Eval

Hello,
because I couldn't wait for Server 2012 to show up on Dreamspark Premium I installed the Datacenter evaluation version after I found this blog
post telling me, I could simply enter my key when I get it to upgrade to the full version.
After entering the command I get notified that "Changing this Windows edition is not supported online for a domain controller.".
The TechNet article for upgrading evaluation versions states the following:
"If the server is a domain controller, see http://technet.microsoft.com/library/hh472160.aspx for important steps to follow before proceeding."
and taking me to an article for installing/uninstalling ADDS without further comments.
Simply typing "slui 3" and entering my key states that I have to enter an eval key.
My question is: Is there a painless way to upgrade my 2012 DC without losing my AD config?
Regards,
Hans

Hi,
Please refer to the following Microsoft TechNet article to confirm if the steps of converting to full retail version are correct.
Evaluation Versions and Upgrade Options for Windows Server 2012
http://technet.microsoft.com/en-us/library/jj574204.aspx
If the warning persists, it means Windows Server 2012 Domain Controller does not support such convert. If so, please install another Windows Server 2012 full retail version or
convert to full retail version and then promote it to an additional Domain Controller for this domain. After that, transfer FSMOs to this new Domain Controller and demote the original Domain Controller.
Regards,
Arthur Li
TechNet Community Support

NTLM Authentication with a domain controller/active directory

Hi,
I have a requirement to do an NTLM authentication with the MS active directory.
I am aware that JNDI doesn't support this protocol to communicate with the AD.
I have looked into couple of online solutions available but that doesn't seem to meet my requirement. Most of the solutions like (Apache commons NTLMScheme/NTCredentials and java.net.Authenticator etc...) are used for only NTLM proxy authentication (where both username, password is sent to the proxy server which does the actual NTLM authentication with the Active Directory.)
What I need is a solution in Java where I can directly contact Active directory for negotiation of challenge/response mechanism.
Can any of you guys suggest any alternative to achieve this ?

it really depends to be honest. I'd probably go something like this though:
One Small physical server to act as a domain controller - you could put DHCP on this too
One or Two physical, quite powerful servers to act as Hyper-V hosts - these can be domain joined.
Then for your VM's create the following:
1 x additional domain controller
For remote desktop services:
1 x Remote Desktop Session Host
1 x Connection Broker
1 x Gateway and web server
For additional services
1 or 2 x Exchange
1 x sharepoint
1 x IIS
but it really depends what you want to achieve.
The benefit from Virtual machines is that you can keep separate virtual servers for separate applications.
If you have two hosts you could then replicate the virtual machines between them if you wanted some layer of fault tolerance.
Hope this helps you a bit more. And thanks for positive blog feedback - its appreciated.
Regards,
Denis Cooper
MCITP EA - MCT
Help keep the forums tidy, if this has helped please mark it as an answer
My Blog
LinkedIn:

Adding new domain controller under tree domain

i have one forest root domain is ABC.com and one tree root domain under this forest is DEF.com ,
i want to add a new domain controller under tree root domain in windows server 2008 r2? i need steps and DNS configuration on forest or domain level
Thnx

If you want to add an additional domain controller to a domain you should promote the new dc with the primary dns in the nic settings of the new dc pointing at the current dc and once promoted you should point the original ip address nic settings to
the new dc. I am making the assumption that you are using AD integrated DNS.
http://www.petri.co.il/how_to_install_active_directory_on_windows_2003.htm
Paul Bergson
MVP - Directory Services
MCITP: Enterprise Administrator
MCTS, MCT, MCSE, MCSA, Security, BS CSci
2012, 2008, Vista, 2003, 2000 (Early Achiever), NT4
Twitter @pbbergs http://blogs.dirteam.com/blogs/paulbergson
Please no e-mails, any questions should be posted in the NewsGroup.
This posting is provided AS IS with no warranties, and confers no rights.

Additional domain controller

Similar Messages

Maybe you are looking for