Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have 2 sites (HO + Branch), both with Win Servers 2003, connected by a tunnel. I want to have a DC in each location to allow for local login/authentication.

Can someone tell me what roles I should assign to the DC's in the remote branches?

I am about to install a Win 2012 DC's in each location in case that matters.

share|improve this question
Don't forget to mark an answer. – mfinni Jan 7 '13 at 22:28
up vote 5 down vote accepted

Typically, if the home office is the largest, that's where all of the FSMO role holders are.

The domain controller(s) at the branches should be both DNS servers and Global Catalogs.

share|improve this answer
Can there be 2 GC roles? How can I add a GC role to the branch? (Without moving it from head office) – Telium Jan 6 '13 at 2:57
Each domain controller can be a Global Catalog server. It's not a role/function that's exclusive to only one DC. You can configure each DC to be a GC from within the Active Directory Sites and Services management console. – joeqwerty Jan 6 '13 at 3:11
Actually you SHOULD have more than 1GC - the GC is the only one that stores all security attributes. If you have only one, that is a desaster in the making. – TomTom Jan 6 '13 at 18:20
Not having a DC as GC is kind of a moot point these days – pauska Jan 6 '13 at 18:26

It essentially doesn't matter where you put the FSMO roles : although it's a good idea to have the PDCe in the office with the most people, since that's the one that handles notifications for password changes, lockouts, etc. With a HQ and a single branch office, you might as well leave all the FSMO roles on the HQ, especially if that's the office with better hardware and better backups.

Edit- as mentioned below, if you only have (and likely only will have) a single domain, you can and should simply make all of your DCs also GC servers - and that's not a role, which is what your question asks for.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.