2

I have a few services that run as a Failover Cluster. At the moment, all the members of the cluster are domain controllers, but that may not always be the case in the future.

The issue I have is that the failover instance has been registered as a domain controller for the domain. Which means that the domain for example.local controllers are:

  • dc1.example.local (Normal DC)
  • dc2.example.local (Normal DC)
  • dcdhcpfo.example.local (Failover Cluster for DHCP , which points to either DC1 or DC2)
  • dccafo.example.local (Failover Cluster for Certification Authority, which points to either DC1 or DC2)

This has become an issue, because those two extra instances do not show up in Active Directory Sites and Services (nor would I expect them to), but they are showing up as an A record for example.local.

Apart from deleting their records from the DNS zone, how can I get rid of them being listed as available domain controllers?

This has become an issue becuase we have some machines in a remote site that are using one of the failover cluster members as the DC they use for authentication, which is making things slow and weird. There is a DC in their local site which it should be using instead; but that's an issue for another day.

Improve this question

1 Answer 1

Reset to default
1

Per a microsoft guide at: http://technet.microsoft.com/en-us/library/cc731844(v=ws.10).aspx

As a best practice, all clustered servers should have the same domain role (either member server or domain controller). The recommended role is member server.

So... I think you answered your own question... either manually fix the DNS entries (don't forget the SRV records!)... or make them all domain controllers.

If it were me, I'd be setting up dedicated DCs instead.

Improve this answer
3
  • Yeah ok. At the moment they are all domain controllers. Interestingly there were no srv records for the failover instances, only A records. I did find some ooolllddd srv records whilst cleaning it out, so it was a good exercise anyway. When I've got time I will probably set up member servers for the roles.
    – Mark Henderson
    Apr 30, 2012 at 0:50
  • Well ya gotta imagine the SRV records are generated for the global catalog servers to service LDAP and kerberos... but then scripting is going to call the domain's namespace to this SYSVOL and NETLOGON which is just an A record right?
    – SpacemanSpiff
    Apr 30, 2012 at 0:53
  • I think the SRV records are also used for replication :|
    – SpacemanSpiff
    Apr 30, 2012 at 0:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .