-1
  1. What is the proper way to distribute work from the pdc to a bdc for authentication.
  2. If the bdc handles authentication, when it increments the bad password count, how is that relayed to the pdc? Does the pdc replicate the bdc (or the bdc is read-only right?)?

We need to determine why a pdc is registering more bad password counts than a bdc so I'd like to first figure out more about how distribution/replication are supposed to work and then troubleshoot.

3
  • 2
    What OS are you running? The concept of 'true' PDC/BDC hasn't existed for a while. You have FSMO role holders, which are authoritative for certain elements, like the forest schema, but otherwise domain controllers are replicas of one another. In 2008+ you can have Read Only DCs (RODC) which are suited to branch offices where the server may not be behind secure doors. But apart from that.. Oct 21, 2011 at 20:31
  • 4
    Talking about PDC/BDC makes us believe this is a Windows NT 4-system --- you should probably clarify your setup.
    – Kvisle
    Oct 21, 2011 at 20:33
  • We are using Windows 2003. I am a developer, not a systems administrator and what you all may think is trivial is quite the opposite for me. I was asked to look into this issue so I'm also research and learning at the same time.
    – cas06d
    Oct 24, 2011 at 12:24

1 Answer 1

5

First and foremost, if you're still using Windows NT (the only Windows domain with a PDC/BDC environment) you're several years past end-of-life of the product. All authentication is handled by the PDC anyway, so load spreading doesn't really exist.

If you're actually talking about an Active Directory domain, the architecture is designed so that all Domain Controllers in the same AD Site are considered to be equivalent workers. This is a result of how the SRV DNS entries are created. When an AD system needs authentication services is queries DNS for the SRV entries of the authentication servers in its AD Site. This is usually (unless some hand tampering has been done) a round-robin of the DCs in the site. Stations tend to glomb onto a single DC and stick with it until it hasn't needed auth long enough for the DNS entries to expire or the DC goes away for some reason.

Some older software will specifically search out the domain controller holding the PDC role and authenticate against that. This is getting a lot more rare these days.

Password and account-status (disable/lockout) events are replicated as immediately as the synch policy allows. All DCs in the same site should get notified of a password change in very short order, generally less than a minute; the same goes for account lockouts and disable/enable events. When traffic is crossing an AD Site, the replication policy governs how fast such events will propagate.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .