3

Is it possible to setup several additional domain controllers (ADC) at remote locations that are connected via medium bandwidth DSL (2-10 Mbit) WAN connections for a single domain (intranet.example.com)? And would it be a good idea?

We have five sites and would like to have extremely high availability if any of the site were to lose their Internet connection. However each site is very small, and all are over a fairly small geographical area within the same region, so it would seem strange to have a PDC for each of the sites.

If it were possible to have an ADC for each site, would the clients use the ADC or just use the PDC if it's available to them?

Improve this question
5
  • There are no such things as ADCs and PDCs. All domain controller are peers. Some domain controllers hold FSMO roles. None are primary, secondary, or additional.
    – MDMarra
    Jun 19, 2012 at 20:18
  • Interesting. I'll keep that in mind. Why does so much literature suggest otherwise? I was led to believe there were such things as primary and backup when I worked as an IT Tech. a few years back and someone told me that was how they'd arranged the servers. Perhaps I was misled at this point.
    – user125248
    Jun 19, 2012 at 20:27
  • PDC/BDC's existed in Windows NT. Active Directory changed the whole design. You do have PDC emulator which servers specific functions (google FSMO) in active directory. No offense, but since it seems you are a little light on your AD knowledge, I would highly suggest testing changes and/or working with more knowledgeable people to set it up right.
    – Rex
    Jun 19, 2012 at 20:43
  • What literature describes primary and backup DCs? It must all be more than 15 years old. That stuff went away with NT4
    – MDMarra
    Jun 19, 2012 at 21:01
  • Would love to give this to someone more experienced. I'll definitely suggest this to the moneyman. However something tells me I'll be asked to find a way. I've setup very simple domain controllers in the past and have some knowledge of OUs and group policies, etc. No offence taken, I would only ever describe myself as a hobbyist in this area.
    – user125248
    Jun 19, 2012 at 21:05

2 Answers 2

Reset to default
2

The short answer is: yes.

You can put DC's at each location. depending on the size of your SYSVOL, you may have some bandwidth issues on initial replication (this can be solved by standing up the DC's local to an existing DC and then moving it to the remote site).

If you design your AD sites correctly, the clients should do primary authentication to the local DC.

If you aren't all that familiar with AD design and configuration, you may want to look at some outside resources to help you with setup/design/install.

2008 R2 would be a much better choice for a number of reasons if you are inclined to upgrade..

Improve this answer
3
  • Could you point me in the right direction when it comes to designing the AD sites correctly?
    – user125248
    Jun 19, 2012 at 20:22
  • for 2003? Start here: technet.microsoft.com/en-us/library/cc787010(v=ws.10). After that, lots of resources out there. Beyond that, find a quality consulting agency
    – Rex
    Jun 19, 2012 at 20:39
  • From a casual bit of reading I can see subnets are generally used to identify workstations with sites, though this can be overriden with a registry entry SiteName. If possible I like to keep all sites on the same subnet so we can simply swap out routers if/when they fail. Are there any other downsides to not using different subnets for each site?
    – user125248
    Jun 19, 2012 at 23:01
1

Yes, they are called Read-Only Domain Controllers and are meant for exactly your scenario. If your current forest is 2003 that's ok, RODCs will need to be Server 2008, but will work with your 2003 forest.

Since it sounds like you don't already have the infrastructure in place at the remote sites, lower powered Server 2008 Core machines would fit the bill.

Explanation

Setup Guide

Improve this answer
4
  • He tagged this post as windows 2003. No RODC in 2003 domains. Assuming he tagged it right, he would not be able to use read only DC's.
    – Rex
    Jun 19, 2012 at 19:57
  • 1
    I made an edit, but if he is buying servers, 2008 Core will be fine.
    – DanBig
    Jun 19, 2012 at 20:00
  • According to technet, the forest functional level only needs to be 2003 or higher for RODCs. You have to have it on a 2008 Server machine, but as far as your domain and forest is concerned, 2003 FL is fine. technet.microsoft.com/en-us/library/cc731243(v=ws.10).aspx
    – HopelessN00b
    Jun 19, 2012 at 20:11
  • Thank you for this reply. I will keep the windows server 2008 option in mind when putting together a plan.
    – user125248
    Jun 19, 2012 at 20:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .