2nd Domain controller

[Bob_m]

Hi All,

I have a small network (15 users) running 2003 AD with one domain controller. I am in the process for adding a second domain controller and have a few questions.

1) My hope is the second domain controller will give me some redundancy if my first controller fails. Does this work the same way as BDC's did with NT domains?

2) Given a 2nd domain controller, if my first domain controller fails, will users be able to authenticate to the domain without any manual interaction?

3) Do I have to worry about FSMO roles, are these automatically synced between the two domain controllers. If not, can they be recreated, lets assume I do not have a backup.

4) When I run DCPromo on my 2nd to-be domain controller, should that be setup as a member server first, or stand alone?

5) I am confuses about the DNS role in AD. Do I have to install a DNS server on the 2nd domain controller? If I did not, would users still be able to authenticate to the domain?

Thanks bob

[Igor Karasik · Accepted solution]

Hi,

1) Yes, generally speaking it will work in same way.

2) Yes, users will use second DC, you don't need manual interaction. But p.5 (second DNS server) is critical

3) If you first DC died you will be able to move FSMO and other roles to second DC
(with ntdsutil)

4) You need to install server as member server

5) You need to install DNS server with AD integrated zone on second DC as well.
All AD based on DNS....

P.S. Please see also:

http://forums1.itrc.hp.com/service/forums/helptips.do?#28

[Bob_m]

>If you first DC died you will be able to move FSMO and other roles to second DC<
Is that because the information in these roles are passed between the domain controllers, and they can be siezed at any time, should your main controller crash and burn?

Thanks Bob

[Igor Karasik]

You can read more about FSMO seizing here:
http://www.petri.co.il/seizing_fsmo_roles.htm

"Moving the FSMO roles while both the original FSMO role holder and the future FSMO role holder are online and operational is called Transferring"

"However, when the original FSMO role holder went offline or became non operational for a long period of time, the administrator might consider moving the FSMO role from the original, non-operational holder, to a different DC. The process of moving the FSMO role from a non-operational role holder to a different DC is called Seizing"