Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have my first domain controller on an Amazon EC2 instance, which is only used for service and administrative accounts for a handful of servers.

I would like to avoid the expense of another server just for an additional domain controller, and was wondering if I could install it on the database server.

Given the light domain usage scenario, would the additional domain controller significantly affect the performance of the database server? Are there other reasons why I shouldn't take this approach?

Edit: Removed the terms "primary" and "backup" DCs. :)

Update: The DB Server is SQL 2008 R2 on Win 2008 R2. The domain controller is SQL 2008 SP2.

share|improve this question
FYI, the concept of primary and backup domain controllers is long dead - nowadays all DCs are created equal. – Ben Pilbrow May 19 '11 at 11:26
Also, what DB server? I'd likely give you a different answer for MS SQL Server and MySQL for example. – Ben Pilbrow May 19 '11 at 11:35
Thanks Ben. I've updated the question. – stucampbell May 19 '11 at 14:36

DC services would eat up a bit of RAM and hardly any CPU resources at all as long as you do not have excessive AD updates or user authentication requests to this DC, so performancewise you are likely not to notice any difference.

There might be security implications, though. A database service is presumably run in some priveleged context like LocalSystem which would allow an attacker ultimate access to your entire AD if he succeeds breaking into the database service. There may be cases where this is not a concern, but mostly it should be.

share|improve this answer
I would tend to agree. The performance implications are probably minimal, but as soon as you promote a server to a domain controller, you loose all local user accounts, and a security hole could have larger implications. – Lucky Luke May 19 '11 at 13:53

I think you're going to get two different answers, both of which are correct:

  1. No it not acceptable and stuff is either going to break, or not be supported. Here is a similar thread

  2. You're going to see answers that say, "I've done this for x number of years and never had a problem."

Both answers are going to be correct. It really depends on your situation. Myself, I would do it in a test bed or non-production environment (developer environment). I wouldn't do it in a production environment.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.