Loss of PDC Emulator Role

[sync23]

since the loss of an WAN link, 2 windows 2003 sites have become seperated.
They are both in the same domain, and both the domain and the forest are at 2003 functional level.

One site had all the FSMO roles, and that site if fine. The other site has no roles, and I am getting errors from Netlogon about not being able to set up a secure session to the PDC Emulator.
However, the site appears to be servicing logons OK, and I have plenty of RIDs left should I need to create objects in the orphaned site.

When the WAN link comes back, the sites will be reconnected, so any siezing of roles is really out of the question.

So my question is, is it safe to reboot the DCs at the orphaned site, or will they deny logon after I do that?

Does anyone have any good documentation about what the PDC emulator *really* does (i.e. is required to create trusts, not just this downlevel logon and password reset stuff you normally read about)

thank,

sync23

[Thomas Bianco]

the PDCEmu does quite a few things.

1) it gets password writes first. when you change a password, it goes to the local DC, then to the PDCEmu immediatly, then through normal replication.

2) it is the authority for the DC computer accounts. if your sites are disconnected for more then 30 days, you WILL have a problem reconnecting them because the computer account passwords would have changed.

3) as you mentioned, downlevel logins.

i THINK you should be ok rebooting the DCs without a connection to the FSMO Masters, but i can't say for certain.

[Norman_21]

Who are the FSMO holders When you issue the command:
netdom query fsmo

The PDC Emulator Role handles password changes, enforces account lockout and synchronize time for all DCs in the domain. So if the System clocks become unsynchronized, kerberos may fail and users will not be able to log on.

However, PDC Emulator advertise itself as the Primary domain controller to workstations, member servers, and domain controllers that are running earlier versions than windows 2000 or windows XP.

I think that the Infrastructure Master handles the sites.

Read MS KB 324801
Also, refer to this link for FSMO Roles Best Practices:
http://www.windowsdevcenter.com/lpt/a/4925

Just my $0.02 Cents as usual