Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Given a resource limited setup consisting of 2 host machines (HyperV-01 and HyperV-02), is it OK to put the domain controllers in parent partition, instead of their own VM?

The main reason is that if the DCs go into a child partition, starting from cold on both machines could lead to a bit of an issue, as there'd be no DCs around until well after both parents have booted. I'm guessing this might cause undesirable effects.

Am I correct to be worried about joining the host systems to a domain that's only on VMs?

The biggest drawback I've heard so far is that if AD gets heavily used, its resources could cut into HyperV's. I'm not concerned about that for this deployment.

Any other suggestions? (Besides finding a 3rd machine and running AD on it.)

share|improve this question
add comment

6 Answers

up vote 4 down vote accepted

It's recommended that you have at least one DC on a physical box, and one that's not also hosting the only other DC. We've got one physical DC (on extremely minimal hardware) and one hosted in Hyper V with no issues whatsoever.

I think that, given your constraints, what you've outlined is the optimal setup.

share|improve this answer
    
I dcpromo'd the HyperV hosts, then depromo'd the DC VMs -- things went fine. –  MichaelGG Jun 11 '09 at 17:02
    
Glad to hear it, and thanks for sharing your results. –  Kara Marfia Jun 11 '09 at 17:42
add comment

While not a Hyper-V shop, our VMware environment has both DCs virtualized. We have cold-start issues even in this environment because DNS lives on the DCs and as such, management features like VirtualCenter have issues when DNS dies.

I would strongly recommend keeping a single hardware based DC outside of your virtual environment. As you mentioned, there can be a variety of issues that while workable, cause unnecessary headaches when you least need them (cold start, disaster recovery, etc).

share|improve this answer
1  
+1 Find a way to get a non-virtual DC and have it be the second or third DNS server. Buy a pizza box server or use outdated hardware. –  tomjedrz Jun 9 '09 at 17:42
    
Right, I was hoping that I could make the HyperV host be the DC as well. Then it wouldn't be virtual, and DNS etc would be available as soon as the parent turns on. –  MichaelGG Jun 9 '09 at 18:04
    
+1 - we've ended up keeping a "real" DC or two out of each domain around for exactly this reason. There's no reasons not to virtualise some of your DCs but I wouldn't do all in a domain. –  RobM Jun 9 '09 at 18:49
add comment

If you have multiple DC's of which any are virtualized there can be issues around replication due to time syncing between the VM and the host.

http://blogs.technet.com/janelewis/archive/2008/04/02/recommendations-for-running-a-domain-controller-virtualized-environment-using-virtual-server.aspx

share|improve this answer
add comment

Why not put the Hyper V host in a separate domain/forest and then your DC and other server VMs in another domain/forest (the production domain)?

Personally though, I kept it simple and did not put my Hyper V host on the domain.

share|improve this answer
    
Well if I can put make a machine a DC and HyperV host, I might as well just put them in the same domain. We've kept them out before, but then I have to deal with security and updates, etc. separately. –  MichaelGG Jun 11 '09 at 0:00
    
dude, then to avoid the cold start issue keep your settings the same with 2 host and a DC on each. Just don't shut both hosts down at the same time. All the servers can be part of the single domain including the hosts. –  Saif Khan Jun 11 '09 at 3:57
    
To add, I have't seen AD put any load on my hyper V and I have VMs on each box. how many users are we takling about? –  Saif Khan Jun 11 '09 at 3:59
    
Not shutting them down at the same time is a great plan. However, I don't have that much faith in datacenter personnel. I've had people accidentally unplug stuff, as well as take down an entire AC circuit. And yea, the load is insignificant. Under 50 users. –  MichaelGG Jun 11 '09 at 17:02
add comment

Due to minimal available hardware is tried to Host VM on a Server tht is also a physical (!) DC. I need 1 DC (physically) an some VM . All for testing and studying.

I read that a DC disables write caching to its harddisk ( To be sure that in case of failure NO data is in cache (which results in that case in dataloss)) There for this will affect the VM hosts in a negative way.

For the ones that understand DUTCH (:-)) read : http://blogs.microsoft.nl/blogs/itprocommunity/archive/2009/05/25/active-directory-in-hyper-v-omgevingen-deel-3.aspx

It's simple advice : keep one piece of hardware for DC purposes others can be virtualised ( if more are needed.)

Guys keep doing the good work and share our thoughts and advices ... Yeahhhhhhhhhhhhhhhh.. (Then i can learn More :-) )

share|improve this answer
add comment

Couple things you need to remember (this said from someone who manages 4 domains with ALL domain controllers virtualized, plus other non-virtualized domains)..

This is a BIG problem:

http://www.bitshop.com/Blogs/tabid/95/EntryId/64/Hyper-V-Domain-Controllers-Virtualized-Space-Time-Continuum-a-warning-about-virtualization-complexities.aspx

Next: Don't save state / snapshot / anything similar - you can be in for a nightmare.

Third: If you get into a situation where your Hyper-V host requires you to log in, yet your domain controller is down, you can end up locked out of starting the domain controller - I haven't seen this on Hyper-V but we had a panic right before we cut over our BitShop corporate domain to virtualized years ago (Virtual Server 2005) - The server couldn't reach the domain controller after a reboot and wouldn't let us log in to start the domain controller virtual instance - We had to use the local administrator account.

So DO keep your local administrator account.

I never run Hyper-V nor Virtual Server on domain controllers, so no experience with that aspect.

Most importantly though the time issue can cause massive confusion on the domain and loss of control of your domain.

share|improve this answer
    
Right, virtualized DCs can be problematic for sure. But running the DC on the host partition, and putting HyperV down -- that works great and avoids the issues you call out. –  MichaelGG Apr 10 '10 at 10:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.