Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is it possible to set on a Windows Client or Server that they only communicate with the same specific Active Directory Server? Maybe trough a Registry Hack?

Kind regards

share|improve this question
    
Can you provide a good reason for wanting to do this? I'm a little confused as to why you think it would be a good idea, and what exactly you are trying to achieve. –  kaerast Jun 1 '10 at 12:22
    
Yes I have => stackoverflow.com/questions/2948504/… –  maveonair Jun 1 '10 at 12:35

4 Answers 4

The issue is not that you're connecting to different AD servers. It's that when you create a new object AD has to contact the RID Master and request a new SID from that server. Once that process is complete AD creates the object, starts a GC update and notifies the Infrastructure Master of the update.

This all takes a second or two to finish (depending on how many AD DCs you have in your domain). After it's created, you can set ACLs using it. But basically, you have to wait.

share|improve this answer
2  
+1 because you're basically right, but a SID is not requested to the RID Master on each object creation; each DC requests SIDs in batches, so that it has some of them available for a while without needing to call the RID Master each time an object is created. –  Massimo Jun 1 '10 at 14:12

The question above from kaerst is an important question. There are probably more appropriate ways of doing this such as using AD sites and subnets for DC selection depending on your AD architecture.

If you're looking for a hack, off of the top of my head, the following might work. A workstation or member server in an Active directory domain uses DNS to identify it's DCs. You can query for the DC like this:

type nslookup

type in the following:

_ldap._tcp.DomainNameHere

For instance, if your domain name is awesome.com you would nslookup for _ldap._tcp.awesome.com. This should return one or more SRV records which are essentially the names of your domain controllers.

Add all the domain controller names to your hosts file and hard code the IP addresses for all these domain controller names to point to the one DC server you want.

share|improve this answer
1  
Nice... but wouldn't DCs become very angry when they're called with a network name that's not their own one? Maybe not on LDAP queries, but this usually happens when accessing network shares. –  Massimo Jun 1 '10 at 14:14
    
Good point Massimo - you have to put a reg hack into servers to accept SMB traffic that points to their IP but is using a different name. It can even be a valid DNS CNAME, doesn't mean Windows will like it without the reg setting. –  mfinni Jun 1 '10 at 14:20

If you can put the system and the DC you want it to use on the same IP subnet, then yes, you can do that by defining a specific Active Directory site only for them.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.