Is it possible to set on a Windows Client or Server that they only communicate with the same specific Active Directory Server? Maybe trough a Registry Hack?
Kind regards
Is it possible to set on a Windows Client or Server that they only communicate with the same specific Active Directory Server? Maybe trough a Registry Hack?
Kind regards
The issue is not that you're connecting to different AD servers. It's that when you create a new object AD has to contact the RID Master and request a new SID from that server. Once that process is complete AD creates the object, starts a GC update and notifies the Infrastructure Master of the update.
This all takes a second or two to finish (depending on how many AD DCs you have in your domain). After it's created, you can set ACLs using it. But basically, you have to wait.
The question above from kaerst is an important question. There are probably more appropriate ways of doing this such as using AD sites and subnets for DC selection depending on your AD architecture.
If you're looking for a hack, off of the top of my head, the following might work. A workstation or member server in an Active directory domain uses DNS to identify it's DCs. You can query for the DC like this:
type nslookup
type in the following:
_ldap._tcp.DomainNameHere
For instance, if your domain name is awesome.com you would nslookup for _ldap._tcp.awesome.com. This should return one or more SRV records which are essentially the names of your domain controllers.
Add all the domain controller names to your hosts file and hard code the IP addresses for all these domain controller names to point to the one DC server you want.
I have solved the problen in anothre way. thanks all! (See my answer: https://stackoverflow.com/questions/2948504/set-ntfs-permissions-with-directorysecurity-after-created-active-dirctory-groups/2950403#2950403)
If you can put the system and the DC you want it to use on the same IP subnet, then yes, you can do that by defining a specific Active Directory site only for them.