Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So basically, we're currently testing out our new 2012 forest/domain and setup 3 2012 DCs. Everything worked well and we were starting to get ready to go into production state soon. Luckily for us, there was a power outage and after that one DC crashed and Windows refuses to start and we've been trying all kind of things these past days to get it to work with no success. Anyway, that's besides the point but just some background information.

The server that crashed is our "primary" DC, or the DC we setup first and installed the forest/domain on. The other two were joined.

We thought with two backup DCs it wouldn't be a problem if one crashed, but apparently it was a huge problem. The other two DCs now cannot connect to the forest/domain, cannot replicate, cannot do anything. Were these DCs just fetching data from our primary DC all the time and basically serving as load balancers?

It's not a huge problem to redo everything (very annoying though) and since we hadn't yet reached the production state we didn't have backups. Although, the data so to speak is still safe on the disks, it's just Windows that cannot start due to winlogon.exe/csrss.exe problem.

So basically my question is: Why does all DCs fail if our "primary" DC fail?

share|improve this question

1 Answer 1

The server that crashed is our "primary" DC,

Does not exist, not since - 2003.

We thought with two backup DCs it wouldn't be a problem if one crashed, but apparently it was a huge problem.

Ok, let me guess. YOu installed AD on that, then on another machine, and noone bothered setting up all other DC as GC (GLobal Catalog)? Or you were lazy and only use one computer as DNS in the clients, so they do not see a domain controller now?

Why does all DCs fail if our "primary" DC fail?

They do not. There are 5 "roles" that have one machine only, and all of them are (a) not immediate failure and (b) can be moved / seized at will. I.e. you ay not be able to create new objects after some time if the mchine responsibel for generating obejctID's is gone, but every machine gets not one numer but a pool to use (so the issue is not there immediately) and you can just move it to another machine.

There is one "PDC Emuator" for stuff like time sync and emulation of old pre kerberos / AD style PDC, but that is just an emulator and the role can be used.

Ther are 2 types of domain controllers though - regular and Global Catalog. Only the later have all the data. YOu can just make a machine a GC (and remove it) - it is just a little marker. But it is not set per default.

So, if you isntall AD, then another 2 controllers, you still have only on GC - and there you go.You just lost your security, at least potentially.

Then there is the issue with DNS - did you configure the client machines (and servers) properly to use multiple AD instances as DNS?

Btw., that goes back to Windows Server 2003.

I would suggest running diagnose on another domain controller.

http://technet.microsoft.com/en-us/library/cc961826.aspx

share|improve this answer
    
The thing is, the other two should've been setup as GCs as well. At least, if you can trust what Microsoft said during the promotion process. The checkbox for "Global Catalogue" was definitely checked when we promoted the servers -- I think it's even set ticked as default. We have DNS setup properly, I think. We cannot get it to work in any way. The AD refuses to show anything and just says failed to find any forest/domain. –  P Soderstrom Jan 17 '13 at 9:32
1  
Check DNS then. THis smells like a DNS issue. –  TomTom Jan 17 '13 at 9:37
    
Have to agree with this answer. Based on the question it seems like a lot of assumptions are being made. –  Diago Jan 17 '13 at 10:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.