Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using the instructions here:

to try and limit a particular 2003 DC from servicing authentication requests. I set the LdapSrvPriority to 250 (rather than the default 0), restarted the DC, and confirmed this has updated in DNS. I have also confirmed that the TTL on the DCs LDAP DNS entries are 10 minutes. It is now 30 minutes later. According to my reading, this DC should now not service authentication requests unless there is no other DC available of a lower priority.

When looking in the Security log on the DC, I see it is still servicing requests (users and computers) - over 100 a minute. Does anyone know why this is the case? Domain members are by definition all AD aware so I would not expect to see computer authentication requests against this DC when I have 4 other DCs with a lower priority available in the site.

share|improve this question
up vote 0 down vote accepted

To close this off:

Not sure why the computers were still authenticating, but the users were doing so because they had an old Novell client installed that was specifically targetting the PDC for lookups (discovered this after network and process monitoring some offending machines). Updating the client resolved the effective DOS the workstations were doing against the PDC.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.