Can windows domain controller be virtualized?

Question

Just the question on the title. There is any problem? Any experience on this?

Answer 1

Yes, it can be done. The appropriateness for doing so is up for debate.

• Make sure time stays synced! This is very important. A DC with incorrect time can cause havoc.
• Disable and do not use snapshots. Reverting to an old snapshot in a domain with many DCs will result in massive chaos.
• Do not suspend/pause the domain controller.
• Make sure your VM server does not get overloaded.
• I suggest you run at least one DC within your domain on real hardware, if you have a larger network.

---

Could you explain the snapshot chaos point? Isn't reverting to a snapshot going to act like restoring from backup, i.e. it will sync recent changes from the other DCs?

The active directory is not designed to support that. Once an update has been replicated, it will not be re-replicated. Normally if you are restoring the active directory you need to go through a special procedure. (http://technet.microsoft.com/en-us/library/cc779573.aspx). The KB article Sam Cogan, and gharper mentioned specifically address this point.

In particular, Active Directory does not support any method that restores a snapshot of the operating system or the volume the operating system resides on. This kind of method causes an update sequence number (USN) rollback. When a USN rollback occurs, the replication partners of the incorrectly restored domain controller may have inconsistent objects in their Active Directory databases. In this situation, you cannot make these objects consistent.

We also do not support using "undo" and "differencing" features in Virtual PC on operating system images for domain controllers that run in virtual hosting environments.

---

The Microsoft AD team just posted a new article about how to virtualize domain controllers which includes several recommendations.

Answer 2

Yes, it can be virtualized, no we didn't run into any problems (VMWare ESX & VMWare Server 2), and in my experience, it's pretty much the same as running the DC on a physical server.

Microsoft has an article with things to consider that's worth reading.

Answer 3

Yes, it can be done, I have done it and it works well. You do need to take some things into account when doing it. This KB article provides a good guide to these considerations.

Answer 4

We've had virtualized DC's for years now. I'd recommend using at least two physical hosts setup with ESX and configured with DRS. Within DRS set up a rule to prevent the two VM's (I'm assuming you have a PDC and BDC) from running on the same host. If your hosts are already clustered with DRS enabled just setup the DRS rule.

You can configure your ESX hosts to use NTP for time updates, and within your DC's have the vmware tools sync their time with the ESX host.

Answer 5

It's been a little over a month since I replace our physical DC with a virtual. Utilization is typically VERY low, and it hasn't had a single issue. On an unrelated call into MS virtualization support, I asked a few question, and they didn't have any warnings or caveats to throw at me.

Answer 6

You can virtualize domain controllers (I have a few for test purposes).

Cloning: I create VMs so I can clone them - always promote to a DC after cloning. Sysprep (or any other tools used to regenerate SIDs) destroys domain controllers. You only want to clone without running sysprep in an isolated environment (e.g. a lab manager fence).