How do I Clear a Warning about Best Practices for Running a Domain Controller on a Virtual Machine?

Question

I have a Windows Server 2008 Domain Controller running on a VMware virtual machine. There is a Best Practices Analyzer warning appearing in Server Manager with the following message:

"The domain controller ... should comply with the recommended best pratices guidelines because it is running on a VM."

My question is merely related to clearing the warning. We are aware of the best practices guidelines and I believe we are following them. I don't see any specific tasks to perform which would clear the warning.

Do I need to just exclude the warning from the BPA scans, or will it clear automatically when I do something that brings the machine into compliance with the guidelines?

Answer 1

I don't think it's complaining just because you are running the DC in a VM. It's complaining because there are specific additional configuration steps you have take when running a DC in a VM, not only for the DC itself, but also on the host machine and hosting hardware. It detects that you didn't do one of them.

Answer 2

Short Answer:

Excluding that test is probably your best bet.

But... (Long Answer:)

Honestly you are begging for problems if you're running a production environment on a VM DC (esp if it has the PDC Emulator role).

I answered similarly here: Domain controller not advertising as time server / PDC role is down (in the post and comments.)

Active Directory is very reliant on the time. Regular physical system clocks have the potential to be erratic enough (especially in places with poorly-conditioned power, high electrostatic noise, or even just faulty hardware), that when adding a software-layer-pretending-to-be-hardware, time itself gets 'sloppy'.

While taking a Quantum Leap as a person might be cool, it makes Active Directory angry.

When recommending site setups, I start with two physical DCs at the main site. (For resiliency.) From there they may be supplemented with VM DCs at that site. If you have other sites that warrant DCs on-premises, I start with one Physical DC (optionally supplemented with DCs). The VMs are not to have the major FSMO roles, but I typically make everything a GC. The VMs are only there to help handle load if the physical DCs are overloaded.