Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

we want to set up 2 VMs (01 & 02) as primary license managers (L/M) and then clone them for local office WAN failure backup purposes. All clients across the network would point to the primary 01 & 02 L/M's and then in the event of a WAN failure, we would fire up the local "offline" clones with the same names as the primaries which would allow for local clients to continue working and then shut down the clones when the WAN connection was restore.

The clones have to be the same name and MAC address as the primaries for the license files to work.

Would there be a problem with the clones having the same name as the physical machine even though the actual machine cannot be reached because the WAN went down?

share|improve this question

1 Answer

up vote 2 down vote accepted

If they're exact clones of same machine (that is, having exactly the same SID - obviously the ones in the branch office will have different IPs set after they're cloned) and they are members of a Windows domain you will need to disable the automatic rotation of the workstation trust password. Everything ought to be fine, so long as you only have one online at once.

You can disable that setting in the local policy on the machines under "Computer Settings", "Windows Settings", "Security Settings", "Local Policies", "Security Options", and the entry "Domain member: Disable machine account password changes".

Once that's done your standby machine will remain "fresh" and will still have a valid workstation trust relationship to the domain when you bring it up.

share|improve this answer
Just out of curiosity - the only downside to this is that it's marginally simpler to impersonate that machine? My guess is, effectively just losing compliance with standards that don't concern you if you're a little guy? – Kara Marfia Jul 10 '09 at 18:09
Yeah-- avoiding spoofing of the PC end of the domain/workstation trust is, as I understand it, the reason for the rotation. I'm wondering if the poster could get by not even joining these machines to the domain-- that would make life even easier. I'm jealous that they have license manager software that will run on a VM. Some of the crap I have to deal with screams and yells if it's on a VM and is "unsupported" (leaving me with a nasty point-of-failure that the vendor says "deal with"... >sigh<) – Evan Anderson Jul 10 '09 at 18:11
what if the clone has a different SID? To be honest we haven't really tried the LM on a VM but assuming that it will work and proceeding from there – jdiaz Jul 10 '09 at 18:34
If the "clone" machines have different SIDs that the original machines they aren't the "same machine" to Active Directory. Only one machine or the other can be joined to the AD under a given name at a given time. Giving them both the same SID and the same workstation trust password (as I speak about in my answer) makes them the same machine to AD. If either thing is different then they're not the "same machine" anymore. You'd do well to make sure the license manager runs in a VM before you put too much more time into this. Many of them that I've had the displeasure of working with do not. – Evan Anderson Jul 10 '09 at 19:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.