1

Is it possible to set on a Windows Client or Server that they only communicate with the same specific Active Directory Server? Maybe trough a Registry Hack?

Kind regards

2

4 Answers 4

1

The issue is not that you're connecting to different AD servers. It's that when you create a new object AD has to contact the RID Master and request a new SID from that server. Once that process is complete AD creates the object, starts a GC update and notifies the Infrastructure Master of the update.

This all takes a second or two to finish (depending on how many AD DCs you have in your domain). After it's created, you can set ACLs using it. But basically, you have to wait.

1
  • 2
    +1 because you're basically right, but a SID is not requested to the RID Master on each object creation; each DC requests SIDs in batches, so that it has some of them available for a while without needing to call the RID Master each time an object is created.
    – Massimo
    Jun 1, 2010 at 14:12
0

The question above from kaerst is an important question. There are probably more appropriate ways of doing this such as using AD sites and subnets for DC selection depending on your AD architecture.

If you're looking for a hack, off of the top of my head, the following might work. A workstation or member server in an Active directory domain uses DNS to identify it's DCs. You can query for the DC like this:

type nslookup

type in the following:

_ldap._tcp.DomainNameHere

For instance, if your domain name is awesome.com you would nslookup for _ldap._tcp.awesome.com. This should return one or more SRV records which are essentially the names of your domain controllers.

Add all the domain controller names to your hosts file and hard code the IP addresses for all these domain controller names to point to the one DC server you want.

2
  • 1
    Nice... but wouldn't DCs become very angry when they're called with a network name that's not their own one? Maybe not on LDAP queries, but this usually happens when accessing network shares.
    – Massimo
    Jun 1, 2010 at 14:14
  • Good point Massimo - you have to put a reg hack into servers to accept SMB traffic that points to their IP but is using a different name. It can even be a valid DNS CNAME, doesn't mean Windows will like it without the reg setting.
    – mfinni
    Jun 1, 2010 at 14:20
0

I have solved the problen in anothre way. thanks all! (See my answer: https://stackoverflow.com/questions/2948504/set-ntfs-permissions-with-directorysecurity-after-created-active-dirctory-groups/2950403#2950403)

0

If you can put the system and the DC you want it to use on the same IP subnet, then yes, you can do that by defining a specific Active Directory site only for them.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .