Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Just the question on the title. There is any problem? Any experience on this?

share|improve this question
add comment

6 Answers

up vote 30 down vote accepted

Yes, it can be done. The appropriateness for doing so is up for debate.

  • Make sure time stays synced! This is very important. A DC with incorrect time can cause havoc.
  • Disable and do not use snapshots. Reverting to an old snapshot in a domain with many DCs will result in massive chaos.
  • Do not suspend/pause the domain controller.
  • Make sure your VM server does not get overloaded.
  • I suggest you run at least one DC within your domain on real hardware, if you have a larger network.

Could you explain the snapshot chaos point? Isn't reverting to a snapshot going to act like restoring from backup, i.e. it will sync recent changes from the other DCs?

The active directory is not designed to support that. Once an update has been replicated, it will not be re-replicated. Normally if you are restoring the active directory you need to go through a special procedure. (http://technet.microsoft.com/en-us/library/cc779573.aspx). The KB article Sam Cogan, and gharper mentioned specifically address this point.

In particular, Active Directory does not support any method that restores a snapshot of the operating system or the volume the operating system resides on. This kind of method causes an update sequence number (USN) rollback. When a USN rollback occurs, the replication partners of the incorrectly restored domain controller may have inconsistent objects in their Active Directory databases. In this situation, you cannot make these objects consistent.

We also do not support using "undo" and "differencing" features in Virtual PC on operating system images for domain controllers that run in virtual hosting environments.


The Microsoft AD team just posted a new article about how to virtualize domain controllers which includes several recommendations.

share|improve this answer
    
Could you explain the snapshot chaos point? Isn't reverting to a snapshot going to act like restoring from backup, i.e. it will sync recent changes from the other DCs? –  Neobyte May 30 '09 at 2:26
    
Ah, yes, USN rollback. A truly lethal one, that. –  Massimo Aug 31 '09 at 20:51
2  
Of course, using a snapshot of a virtualised DC in an isolated network in DR testing is a nice way to save some time. –  Richard Gadsden Oct 2 '09 at 11:09
add comment

Yes, it can be virtualized, no we didn't run into any problems (VMWare ESX & VMWare Server 2), and in my experience, it's pretty much the same as running the DC on a physical server.

Microsoft has an article with things to consider that's worth reading.

share|improve this answer
add comment

Yes, it can be done, I have done it and it works well. You do need to take some things into account when doing it. This KB article provides a good guide to these considerations.

share|improve this answer
add comment

We've had virtualized DC's for years now. I'd recommend using at least two physical hosts setup with ESX and configured with DRS. Within DRS set up a rule to prevent the two VM's (I'm assuming you have a PDC and BDC) from running on the same host. If your hosts are already clustered with DRS enabled just setup the DRS rule.

You can configure your ESX hosts to use NTP for time updates, and within your DC's have the vmware tools sync their time with the ESX host.

share|improve this answer
1  
+1 for DRS "keep machines apart" rule. –  Greg Work May 29 '09 at 22:45
add comment

It's been a little over a month since I replace our physical DC with a virtual. Utilization is typically VERY low, and it hasn't had a single issue. On an unrelated call into MS virtualization support, I asked a few question, and they didn't have any warnings or caveats to throw at me.

share|improve this answer
add comment

You can virtualize domain controllers (I have a few for test purposes).

Cloning: I create VMs so I can clone them - always promote to a DC after cloning. Sysprep (or any other tools used to regenerate SIDs) destroys domain controllers. You only want to clone without running sysprep in an isolated environment (e.g. a lab manager fence).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.