Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using the instructions here:

http://technet.microsoft.com/en-us/library/cc737541%28WS.10%29.aspx

to try and limit a particular 2003 DC from servicing authentication requests. I set the LdapSrvPriority to 250 (rather than the default 0), restarted the DC, and confirmed this has updated in DNS. I have also confirmed that the TTL on the DCs LDAP DNS entries are 10 minutes. It is now 30 minutes later. According to my reading, this DC should now not service authentication requests unless there is no other DC available of a lower priority.

When looking in the Security log on the DC, I see it is still servicing requests (users and computers) - over 100 a minute. Does anyone know why this is the case? Domain members are by definition all AD aware so I would not expect to see computer authentication requests against this DC when I have 4 other DCs with a lower priority available in the site.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

To close this off:

Not sure why the computers were still authenticating, but the users were doing so because they had an old Novell client installed that was specifically targetting the PDC for lookups (discovered this after network and process monitoring some offending machines). Updating the client resolved the effective DOS the workstations were doing against the PDC.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.