Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been working through some Exchange training documentation (the official MS e-learning package) and all of the design scenarios allude to placing at least one DC from your forest root domain in every site.

I'm not sure whether this just relates to Exchange, but I can think of a number of issues we experience in our forest that would be resolved by this. For example, a Microsoft support engineer has stated that EVERY client in a child domain (i.e. all workstations and member servers) need access to a forest root DC to check certificate/template permissions, even on a subordinate CA.

I have attempted to locate documentation or guidelines from Microsoft on this, but have not been able to find anything. I found the Domain Controller Placement guide, but it's only a form - you would use it to document where you will place your DCs, but it doesn't give any guidance on where you should deploy them.

Does anyone know where, or if, I can find any such documentation?

EDIT: To clarify, I'm wondering if there is any documentation (specifically from Microsoft) that anyone is aware of that states there is value in having a forest root domain DC in every site, even for sites that are otherwise exclusively for a child domain.

Specifically relating to the CA situation, the MS engineer who worked on a case we had open referenced this Technet blog post, where they describe an isse with every client (including workstations) requiring access to a DC in the forest root domain. But what I haven't been able to find is any design/architectural documentation from MS that suggests this design.

share|improve this question
    
What is your question? This is more of a statement –  t1nt1n Jul 11 '12 at 7:36
    
Sorry you are correct. I've updated the final paragraph. –  Matt Jul 11 '12 at 7:48

1 Answer 1

This is a system requirement as you can read here:

http://technet.microsoft.com/en-us/library/aa996719.aspx

"In each Active Directory site where you install Exchange 2010, Exchange 2010 must be able to contact at least one writeable domain controller of the domain of which Exchange 2010 is a member."

share|improve this answer
    
Just to clarify for the OP, that doesn't mean you need to install a writable DC at every ADDS site, just that every Exchange server has to be able to contact a writable DC for its domain. Plenty of smaller environments just have a DC at their primary site, and as long as their Exchange servers can contact it, they're fine. Also, as it relates to the CA tangent, CAs do not need to be placed on DCs. –  HopelessN00b Jul 15 '12 at 13:41
    
Thanks, this wasn't really an Exchange question, just using it as an example. –  Matt Jul 19 '12 at 0:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.