I know this question has been asked quite a while.
But still it isn't really clear to me.
Why am I not clear?
People suggest sometimes that it is preferable to have 1 DC on physical Hardware. (Even Microsoft says this). Also it is planned to have Exchange Server and other cirtical Company data on the same physical machines on diffrent VMs. I heard that people could still break through the guest system and comprimise every Virtual machine, is that true?
So is it good to virtualize all domain controllers?
Edit: Try to make my question more On-topic.
Something about me and my situation
Currently I'm a junior Developer and try to learn a lil bit more about system administration, so I help small companys in my free time. I try to help them with their infrastructure, like planning, administrating and setup new servers / hardware.
One of my company asked me if it is possible to virtualize Domain Controllers.
Their current Setup are 3 Servers, where every Server has a certain role.
Roles of the 3 Servers:
- DC and Exchange on the same machine
- Terminalserver for CRM and Office.
A tape drive is makes backups of the 3 servers.
They also have 3 servers that aren't connected to power, who acts as a drop in replacement for the other servers, if one server fails.
I told them that it is a waste of money if these server won't get used until they got replaced.
So they worked on a new IT concept with a new IT company.
2 Servers virtualized with Hyper-V in a active/passive configuration. Virtualize everything:
- Terminalserver with CRM and Office
The concept seems to be really good, but I had something in my mind that there could be some problems with the virtualization of an Active Directory.
Why am I concerned
I came to this conclusion since I experimented with FreeIPA (something like Active Directory) on my local company, since we try to integrate some Linux Devices and looking for a Synchronization with FreeIPA.
We virtualized FreeIPA on Hyper-V and KVM and had massive problems with the time synchronization service, so we also had problems with the login of our systems.
I also searched the whole Internet and the Microsoft related sites about this specific topic, but every link says that it's still recommend to run 1 DC on physical hardware.
Here is the technet article which confused me.
Maintain physical domain controllers in each of your domains. This mitigates the risk of a virtualization platform malfunction that affects all host systems that use that platform.
Which risks could occur?
Which bugs / exploits / whatever could occur on a virtualization platform?
And still if we have 2 virtualized server (which are the same hardware, 2 Dell Servers R520) is there a huge risk that the bug/exploit hit both servers?
Also we still making backups so we could still recover everything if we would hit a bug.
Anyway the company didn't have a redundant setup before and they said that it isn't their biggest concern. They don't want to lose data and they don't want to have any security risk.
I already have 1 good answer from MDMarra and he clears up something for me.
But still he said its more a availability question than a security one, but when the hyper-v platform has a catastrophic failure i would still lose data/have a security hole.
Maybe I'm a little bit paranoid, but as more components are thrown at some hardware the more will security risks occur.
Maybe I need more answers to solve my questions correctly since I'm still wouldn't say to any customer that Its a good way to virtualize everything.