Clustering Configuration with Primary & Secondary Domain Controllers
Hello.
I am trying to configure Failover Clustering on my Server 2012 computers.
I have a primary domain, as well as a secondary domain.
We will call them dc1.domain.com and dc2.domain.com.
I have Failover Clustering Manager installed on both servers.
Upon adding them both to the Create A Cluster Wizard, I receive the following error message on my report.
(My account is fairly new, so it will not let me attach an image, but I assure you, it is safe)
s14.postimg.org/lssjm2vu9/Screenshot_1.png
More that trying to avoid clustering domain controllers, you simply cannot do it. Active Directory has high availability built into it. It is known as multimaster, meaning there is no primary and secondary domain controllers. All are 'masters',
meaning you can make changes on any domain controller and the change will be replicated to the other DCs.
If you only have two physical servers and you want to cluster them, you will first need to install the Hyper-V role on the servers (it is not recommended to install both Hyper-V and Domain Controller on the same box, so we will get this fixed). Once
you have Hyper-V installed, build a VM on each server, join them to the domain, and promote them to domain controllers. On one of the VMs, seize the FSMO roles from the FSMO master. Then demote the physical hosts from being domain controllers.
You can now form a cluster of the two physical servers.
. : | : . : | : . tim
Similar Messages
-
Windows Server Primary & Secondary Domain Controller Question
lulzchicken wrote:
Right now the DHCP is assigning 192.168.200.1 (DNS server) and 8.8.8.8 (Google's DNS) as DNS servers for each client. I don't necessarilly want to change these assignment settings,Yes, you do. This is absolutely the worst thing you can ever do with DNS. More details why here -> Ramblings of a Sysadmin: How to do DNS correctly
Primary and secondary DNS should ALWAYS be internal.
Your DNS Servers should use FORWARDERS go go out to google. That's the only place that should see google DNS servers in your environment.Hi everyone, thank you for taking the time to listen.
I have successfully implemented an Active Directory setup using a Primary DC and a Secondary DC with Windows Server 2012 R2.
EL1 is my PDC and EL2 is my BDC.
Active Directory is in sync among the two Domain Controllers. Here is my question:
If I were to have a policy (Group Policy) that sets the wallpaper of each client machine to whatever is in the "\\EL1\Wallpaper\wp.jpg" - what would happen if I were to have that Domain Controller fail? That directory is no longer available due to the outage - even though the Backup Domain Controller will still be pushing out the policy (pointing to the down server).
My idea was to have that directory replicated on the Backup Domain Controller, "\\EL2\Wallpaper\wp.jpg" however - the policy will still be looking for the file in the Primary Domain...
This topic first appeared in the Spiceworks Community -
Problem with primary/secondary keys in table with included structures
Dear ABAPers,
we have a structure which is supposed to be included in the definition of several tables.
The problem is the following:
depending on the application table that includes this structure, 3 or 4 fields of that structure may
or may not be necessary to enhance the table key. As far as I know included structures can only
completely be marked as keys. Therefore I suggested to split up the structure into two parts,
one part with the possible candidates that may become key fields, and the rest, and of course
a structure that unites both of these substructures. So when it comes to reusing this structure
the developer would have the choice to select the structure with all of the fields in case no field
is needed as additional key, or the developer would have to implement both of the substructures
separately with the option to mark the key-part of it as key in his table.
But unfortunetaly this suggestion of mine was refused as being too complicated and I am supposed
to define all the fields in one flat structure and to "enhance" the primary keys (that always will exist)
by secondary keys.
Does anybody know how that is supposed to work without defining double indexes?
I cannot activate a table without having primary keys defined and any unique secondary index would
allways include all of the primary keys.
Thanks in advance for you help
(I'm sorry that you cannot be granted reward points for just reading the extensive problem description)
regards
AndreasDear Rob,
since your answer was helpful and since it was the only one I will grant you full points on that.
Thanks again for your input. In case other developers should look this thread up being confronted
with the same kind of problem, here is how we solved it:
We added an artificial primary key (a number of type NUMC 8) to the table which is supposed to
include the structure. This key alone takes care of the uniqueness of eacht entry.
All the others fields that we want to have available for a fast direct access, including the ones
from the included structure, are put together in a secondary index.
best regards
Andreas -
They have been up and running for over a about a year on XSAN 2 and all of a sudden started having problems with data transter and then won's connect anymore
ThanksQuote
amd 64=12a @12V
ati 9800=7.5~10.5a @12V (assuming 90~125 watts) a max load,
a 9600 ir nvida 5200 used far less power
so your already at 18a with no fan,s no hd, no cd,no dvd ,no mobo chipset , no mem, no sound..etc
If you exclude the motherboard, memory, etc like you did there, the amd 64 draws 7.2A @ 12V.
90~125W for an ATI 9800?! [irony]Are you working for a PSU manufacturer or what?[/irony] That's just absurd.
Go read this post to get a feel for the actual power consumption: https://forum-en.msi.com/index.php?postid=297061&sid=#post297061 -
Secondary domain controller not able to connect from work stations.
We are using primary and secondary domain controllers. In which the secondary domain controller act as a replication server. actually the problem occurs while accessing the secondary domain controller from work stations I get the following error:
"The trust relationship between this workstation and the primary domain failed".
Any one please give as a solution.
Thank you.Hi,
Most simple resolution would be unjoin/disjoin the computer from the domain and rejoin the computer account back to the domain.
There might be multiple reasons for this kind of behavior.
Here are a few of them:
Single SID has been assigned to multiple computers.
If the Secure Channel is Broken between Domain controller and workstations
If there are no SPN or DNS Host Name mentioned in the computer account attributes
Outdated NIC Drivers.
According your description, the second one may be the cause of your problem.
When a Computer account is joined to the domain, Secure Channel password is stored with computer account in domain controller. By default this password will change every 30 days (This is an automatic process, no manual intervention is required).
Upon starting the computer, Netlogon attempts to discover a DC for the domain in which its machine account exists. After locating the appropriate DC, the machine account password from the workstation is authenticated against the password on the DC.
If there are problems with system time, DNS configuration or other settings, secure channel’s password between Workstation and DCs may not synchronize with each other.
A common cause of broken secure channel [machine account password] is that the secure channel password held by the domain member does not match that held by the AD. Often, this is caused by performing a Windows System Restore (or reverting
to previous backup or snapshot) on the member machine, causing an old (previous) machine account password to be presented to the AD.
Follow below link which explains typical symptoms when Secure channel broken,
Typical Symptoms when secure channel is broken
http://blogs.technet.com/b/asiasupp/archive/2007/01/18/typical-symptoms-when-secure-channel-is-broken.aspx
For detailed information, please refer to the link below,
Troubleshooting AD: Trust Relationship between Workstation and Primary Domain failed
http://social.technet.microsoft.com/wiki/contents/articles/9157.troubleshooting-ad-trust-relationship-between-workstation-and-primary-domain-failed.aspx
Hope this helps.
Steven Lee
TechNet Community Support -
Connect two domain controllers to SAN storage
Hi everyone
I have primary and secondary domain controllers, I want to connect them to SAN storage as a cluster, I tried to configure Failover Clustering on them, but when adding them both to the Create A Cluster Wizard, I receive the following error (see the link)
http://s14.postimg.org/lssjm2vu9/Screenshot_1.png
so, is there any solution for this error, or may be there is another way to connect both DCs to the storage as cluster.
any help will be appreciated,Hi,
as I know this configuration is not supported.
http://support.microsoft.com/kb/2795523/en-us
Regards
Guido -
Problems Removing Secondary Domain and agents
I had a secondary Domain and a gwia and webaccess agent running on an vm box. The box had issues and crashed and I was unable to recover it. I am now left with a secondary domain and two gateways that I can cannot get rid of because the edir objects are gone. I get this error when I try to connect to the gateways....E-Directory counterpart of this object does not exist. The objects are not in edir. I am also unable to delete the domain because it has subordinates left under it. What are my choices for cleaning this out. I really would like to get this resolved before I try to upgrade to GW8.
Thanks so much for your help!
Rodney NealThis can be fairly difficult given your situation of not being able to recover the server so you might consider opening a service request with a partner or Novell Technical Support. I will try to give you the steps to follow though here..
1. You need to first get the object back in the tree. To do this, you must graft them in by selecting a container in the tree and selecting Tools|GroupWise Utilities|GW/eDIr Associations|Graft GroupWise Objects. Follow the wizard through all the steps. This should get you the objects back though I do not understand why they would be gone in the first place with just a server crash. I assume that eDir was on other servers as well so wondering if you manually deleted the objects but either way, that is what you need to do.
2. This is where it can be a bit tricky. You need to create a temp folder on the server and rebuild the secondary domain into that folder so that you have a database to work with. Just go to properties of that secondary domain and change the UNC path to point to the temp folder and then under GroupWise Utilities|System Maintenance choose Rebuild Database. In the end, there should be a wpdomain file in that temp folder.
3. Copy in all the .dc files from your primary domain root folder into this temp folder.
4. You now need to Release that secondary domain from the GroupWise system. To do this, make sure you are connected to the primary GW domain and then right click on the secondary in question and choose GroupWise Utilities|GroupWise System Maintenance and then there is an option to release secondary. This also brings up a wizard to walk you through the process.
5. Now the secondary should show up in your live system as an external system. You just need to go under Tools|GroupWise System Operations|External System Synchronization and delete the new link it automatically created.
6. Now you can just delete the objects. You may need to delete them separately from the tree afteward.
Let me know if you have any more questions or need clarification. -
Primary/secondary question
IS it possible to have a primary domain and po as GW 2012 on Linux with a secondary domain and po holding at GW 8 on Netware? - Not sure how fast I will be able to get out to the secondary location.
If not, I'll have to migrate the secondary (or move all of it's users to the primary - delete it, and create a new one on a linux box)
Thanks
DOn Thu, 29 May 2014 21:16:02 GMT, DNewman
<[email protected]> wrote:
>
>IS it possible to have a primary domain and po as GW 2012 on Linux with
>a secondary domain and po holding at GW 8 on Netware? - Not sure how
>fast I will be able to get out to the secondary location.
>If not, I'll have to migrate the secondary (or move all of it's users to
>the primary - delete it, and create a new one on a linux box)
>
>Thanks
>D
GW 2014 is out...maybe consider that instead of GW 2012.
But as to your original question, it will work, but if you upgrade
WebAccess to 2012/2014, I don't believe it can access the older PO. So
you may need to hold off on WebAccess until you can upgrade the
secondary location.
Ken -
CAPWAP Primary/Secondary/Tertiary Question
After going to the High Availability Tab in the WLC GUI and setting the primary, secondary, and tertiary, how do you see that in the CLI in the AP?
I tried using show capwap ip config, it doesn't show any entries at all?
And also, is there a command to do that in the CLI in the AP? to set the primary, secondary, and tertiary?
Thank you."ou need to run th config ap... from a WLC. You have autonomous AP's so you need to convert them to LWAPP and you also need a WLC to do this."
It's been converted to LWAPP, but haven't joined a WLC yet.
What I wanted to do was configure a primary, secondary before joining it to a WLC.
Because what I would of done is first have it join a controller, then go into the GUI and change the HA (High Availablilty) and add the primary/secondary controllers.
Thought if I could skip the first step and try to configure it from the AP. -
Why some APs would register with Secondary WLC while they are configured to Primary WLC
Dears,
I faced strange behavior i have two WLC one primary and the other one secondary.
some AP join to secondary WLC for short period (2 min or less) and returned to primary, while they are configured to primary WLC.
Two WLC image version: 7.4.121.0
Wait your replies plz.
Thanks,please find Logs from Secondary WLC. and i can't get Access point logs cause i Remote site.
465 Tue Jun 3 13:20:36 2014 AP '90068-02', MAC: 34:a8:4e:bb:08:90 disassociated previously due to Link Failure. Uptime: 0 days, 18 h 46 m 25 s . Reason: Capwap WTP Event request.
466 Tue Jun 3 13:20:36 2014 AP on the 802.11a radio with Base Radio MAC 34:a8:4e:bb:08:90 (90068-02) is unable to associate. The regulatory domain configured on it '-E' does not match the controller's regulatory domain: -C
493 Tue Jun 3 13:16:59 2014 AP '90068-02', MAC: 34:a8:4e:bb:08:90 disassociated previously due to Link Failure. Uptime: 0 days, 18 h 42 m 55 s . Reason: Capwap WTP Event request.
494 Tue Jun 3 13:16:59 2014 AP on the 802.11a radio with Base Radio MAC 34:a8:4e:bb:08:90 (90068-02) is unable to associate. The regulatory domain configured on it '-E' does not match the controller's regulatory domain: -C
59 Tue Jun 3 13:20:42 2014 AP '90068-01', MAC: 34:a8:4e:bb:06:30 disassociated previously due to Link Failure. Uptime: 0 days, 18 h 47 m 17 s . Reason: Capwap WTP Event request.
460 Tue Jun 3 13:20:42 2014 AP on the 802.11a radio with Base Radio MAC 34:a8:4e:bb:06:30 (90068-01) is unable to associate. The regulatory domain configured on it '-E' does not match the controller's regulatory domain: -C
0 Tue Jun 3 14:51:09 2014 Coverage hole pre alarm for client[1] 94:01:c2:82:26:27 on 802.11b/g interface of AP 54:78:1a:88:2c:c0 (90002-01). Hist: 0 0 1 1 4 8 26 30 22 24 12 21 9 7 3 7 2 2 1 1 0 0 0 0 0 0 0 0 0 0 0
1 Tue Jun 3 14:51:09 2014 Coverage hole pre alarm for client[1] 88:32:9b:5f:e7:91 on 802.11b/g interface of AP 54:78:1a:88:2c:c0 (90002-01). Hist: 1 4 7 15 4 9 4 4 3 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
2 Tue Jun 3 14:51:09 2014 Coverage hole pre alarm for client[1] cc:3a:61:69:d9:4c on 802.11b/g interface of AP 54:78:1a:88:2c:c0 (90002-01). Hist: 0 0 0 0 0 2 13 16 19 13 5 6 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
3 Tue Jun 3 14:51:09 2014 Coverage hole pre alarm for client[1] bc:44:86:09:f1:ec on 802.11b/g interface of AP 54:78:1a:88:2c:c0 (90002-01). Hist: 0 0 0 3 21 24 13 6 2 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 0 2 3 0 0
Wait your feedback plz.
Thanks, -
Using Windows 8.1 With Older Domain Controllers
Is there any document that would specify types of incompatibility we might expect when using Windows 8.1 with older domain controllers, either Windows 2000 or Windows 2003?
I assume at minimum that these older domain controllers would not have group policies that are able to support the full security policy feature set of Windows 8.1? For such cases, how do we configure security policy on those 8.1 domain member
computers? Would we use LocalGPO.wsf to import a local security policy, then join the computer to the domain to override just the settings that are supported by the domain controller and windows 8.1 in common?
WillHi,
You could refer to below guide to complete your migration process:
Step-By-Step: Active Directory Migration from Windows Server 2003 to Windows Server 2012 R2
http://blogs.technet.com/b/canitpro/archive/2014/04/02/step-by-step-active-directory-migration-from-windows-server-2003-to-windows-server-2012.aspx
Meanwhile, about the details how to migrate the doamin controller, I would like to suggest you consult Windows Server Forum for more professional help:
http://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserverDS
Karen Hu
TechNet Community Support -
Register Secondary ACS with Primary ACS 5.4 patch 6 and getting error
Scenario #1:
prodacs1 and prodacs2 version 5.4 patch 6 with IP address of 10.1.1.1/24 and 10.1.1.2/24, respectively.
Both prodacs1 and prodacs2 are running on VMWare ESXi 5.1. Both are sync'ed with Active Directory
and authenticate users to manage Cisco routers and switches without any issues. prodacs1 is the Primary
and prodacs2 is the Secondary. BOTH prodacs1 and prodacs2 USE THE SAME LICENSE. Both prodacs1 and
prodacs2 are resolved in DNS for both forward and reverse lookup. In this production environment, everything is working as expected.
Scenario #2: NEW deployment in the lab
labdacs1 and labacs2 version 5.4 patch 6 with IP address of 192.168.1.1/24 and 192.168.1.2/24, respectively.
Both labacs1 and labacs2 are running on VMWare ESXi 5.1. Both are sync'ed with Active Directory. BOTH
labacs1 and labacs2 USE THE SAME LICENSE as scenario #1. Both labacs1 and labacs2 are resolved in DNS for both
forward and reverse lookup.
However, when I tried to add labacs2 into labacs1 so that labacs2 is the secondary and labacs1 to be the
primary. From labacs2 interface: System Administration >Operations >Local Operations >Deployment Operations,
I enter the hostname/IP address, username/password of labacs1, then I click on "Register with Primary", I get
this message:
This System Failure occurred: server cannot be added to the deployment.
Server has same License ID as server labacs1 that already exists in the deployment.
Your changes have not been saved.Click OK to return to the list page.
Why is not working? Furthermore, why is it working in one environment but not the other with the same
idetical ACS version & patch. Work in production environment but not other.
Anyone has run into this before? how do you fix this?What type of license are you using in first deployment?
There are 2 type of licenses
Base license - Install a unique base license for each of the ACS secondary servers in the deployment.
Large Deployment add-on license - It allows a deployment to support more than 500 network devices. Only one Large Deployment license is required per deployment, as it is shared by all instances
Please check what type of license are you running in your deployment.
In order to fix issue in your 2nd deployment you need reset-application config on your secondary, install the new unique base license (based on show udi) and register it to primary node to get the configuration replicated.
Regards,
Jatin Katyal
**Do rate helpful posts** -
DNS issues with replaced domain controllers
I have slight issue I hope some one can help with.
We recently replaced some domain controllers in our 2 core sites the process we followed is as below:-
moved FSMO roles to different already working servers
demoted the old domain controllers and decommissioned.
built virtual machine replacements with the same names.
depromo'd the servers
ran all the tests and it reported everything was fine.
moved the fsmo roles to the new servers.
repeated this for the remaining servers.
this was our 2003 domain to free up physical space but our new 2013 domain what will exist separately until all our applications our tested.
however the problem we now have is that non domain controllers have issues registering against the new servers despite being able to do look-ups against them all (replication testing looks fine). one of our regional DC's seems to have taken over as the primary
replica. as changes made else where disappeared but changes made there got replicated out perfectly.
I have managed to resolve this particular issue by added the domain controllers back into several locations in DNS manually (maining forward lookup zones>my domain>_tcp )but we still experience the odd issue with servers not registering in DNS properly
(although it's a lot better since the I did the above)
so basically does any one have a idea on what could have caused this issue and how I can resolve?should the demotion not automatically remove it from sites and services automatically (it could well be this if not) the question then becomes how do we resolve the issues we have now.
Hello,
NO, as you can demote a DC and it still may run site-aware services like DFS and for this reason a DC is NOT automatically removed from AD sites and services during demotionprocess.
Best regards
Meinolf Weber
MVP, MCP, MCTS
Microsoft MVP - Directory Services
My Blog: http://blogs.msmvps.com/MWeber
Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.
Twitter: -
Still having issues with AP primary/secondary controller option
Customer has two primary controllers each in HA SSO, each using v7.6.130.0, FUS 1.9.0.0; the AP population is a mixture of mostly 3502, 3602 and 1142. Both WLC's management interfaces are in the same vlan and the mobility communication is up. AP fallback is enabled on both WLC.
Over the weekend the upgrade to 7.6.130.0 was completed and the first AP tested with primary controller defined worked on the first attempt. Every successive reboot of the AP always worked. This did not work previously when the WLC was on v7.6.100.0.
L2 client roaming between APs joined to different controllers also worked great.
While the roaming test was being carried out, a few APs not involved with the testing migrated over to the new controller. This wouldn't be a problem but there are about 15 APs that must reside only one controller. As luck would have it, 5 of the APs which migrated to the new controller are APs which must stay on the other controller. Setting their primary controller had no affect. Each time these 5 APs were reset they ignored the primary controller setting and joined the new controller. These were 4 1142 and 1 3502.
What am I missing? I have checked and double checked the configuration, read and reread the documentation. I am working as a contractor and this is starting to look very bad for me if this problem can not be solved.
Thank you for your assistance.I would like to follow up and share the resolution to this problem.
After upgrading to 7.6.130.0 and finally determining that one of the test APs was actually bad, we were able to move forward. Since removing the bad AP from the test, we now have the ability to direct APs to a specific controller at will.
In the testing, we found that using just the system name worked in all test cases. This was confusing since using the FQDN worked for some APs but not all. This issue is why I started this discussion. Nobody homed in on that detail, so I hope this will help someone in the future.
Both the primary controllers are in the same management vlan, we only used the system name.
Good luck to all! -
We have a setup wherein we have integrated ARC server for exchange console services to the call manager.In our cluster CTI Manager services are running on two subscribers-one of them is a primary and the other is secondary.Similary , we have ARC server installed on a primary server and a secondary server.ARC Server uses TAPI and CISCO TSP to integrae with the call manager.In the secondary ARC server, when we go to to ARC aConnect admionistration- console connect-Queue location we see the the same queue location numbers as configured in primary ARC server.When we try to change the queue location numbers, it fails to update ,throws up a pop up which says"Queue location cannot be pointed to a routing device.Kindly select a different number".Could you suggest where the conflict might have been occuring and how can we update the queue location numbers in ARC secondary server?Could you also please explain how the CISCO TSP and TAPI function together?
Thanks a lot Brad,
All is working, just a couple of question, i'm also using voice recognition, it works but it doens't has the
play external messages option, is there any specific i have to set or say?
The touchtone command in my classic conversation is not 7 but i have to execute a little procedure following the
menu, somenthing like 0 --> 9 --> 1 ---> 7 ( external message option ) --> 1
Is there any way to change or abbreviate this ?
Thanks again
Michele
Maybe you are looking for
-
Users can Edit over Web but not iCal
My iCal server was running fine for months. My Groups had calendars enabled and the members of that group saw those calendars in iCal under Accounts->Delegation. I don't know when this happened but now when I add new members to the group, they can't
-
I cant watch videos. Flash player is asking me to update but Firefox is blocking it.
I cant watched videos on YouTube or online stream. its says "This plugin is vulnerable and should be updated. Activate Adobe Flash." When i try to update it Firefox is blocking it for my own protection. Please help me with this problem, i have a Macb
-
Hallo Gurus, as far as you know is the "RFC Interface Generator" still active? It should be under: Tools --> ABAP Workbench ---> Development --> Function library and then utilities -> RFC generate I am working on a SAP ECC 6.0. I need it to genera
-
When I had AIR 3.3 and compiled my project to put onto my iphone for testing, everything worked. However, with AIR 3.4, there's just a blank screen, my backround color. Anyone else experience the same thing, or have a solution?
-
I have uninstalled version 8 and tried to go back to an earlier version, but browser still will not open.