Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently added a 2008 server to an existing 2003 domain. The 08 machine is DC and global catalog. However, it seems like (and makes sense that) when I make changes to policy on the 08 machine, it is propogating to the 03 machine and the clients after gpupdate report that the policy is coming from the 03 machine. This leads me to believe that there is something else that is defining the 03 machine as the master...

I would like the 08 machine to be the primary and 03 to be the backup. Is there a procedure I need to follow to make this happen? What are the caveats (if any)? And are there any features of 08 that I should look into taking advantage of?


share|improve this question
Check the NTDS Settings for your 2003 server In Active Directory Sites and Services. Is that set to a global catalog also? – Nixphoe May 26 '11 at 15:38
all DCs are DCs there is no difference as far as the client is concerned. – Jim B May 26 '11 at 15:54
up vote 4 down vote accepted

There are no "primary" or "secondary" domain controllers in Active Directory.

You shouldn't really be worried about which server is performing authentication or suppling Group Policy to clients. The servers are equal replicas so the functionality is the same. You could tweak preference values on the SRV RR's for the DC's in DNS if you really wanted to, but you'd need a compelling reason to do so.

Why do you care which machine clients are using for Group Policy refresh?

share|improve this answer
Thanks. I don't really care, but I'm trying to get policies to propagate to the client which doesn't seem to be happening. I wasn't clear until I read your answer whether or not there was a master/slave type thing and thought maybe because I was making changes on the new primary DC those changes weren't propagating... Now I know the issue is somewhere else. – stormdrain May 26 '11 at 18:25
Nigh 9 out of 10 Group Policy application problems I've helped out with end up being DNS issues. The client's event log wants to help you, as does 'gpresult' and RSoP. – Evan Anderson May 27 '11 at 2:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.