Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Should the Active Directory PDC always be a physical machine or would it be okay to run it in a VM? What are the implications/trade offs/gotchas?

As a corollary to this, what about running a physical PDC that is also a Hyper-V host? Any implications there (especially for guest VM's that may also be SQL or Exchange Servers?)

Note: Performance implications are secondary. My main concern is gotchas.

share|improve this question
See… – Zoredache Oct 1 '09 at 18:59
See this question: can-windows-domain-controller-be-virtualized – Sam Oct 1 '09 at 19:00
Thanks! Sorry about that! – Matias Nino Oct 1 '09 at 19:13
There are no "PDC's" in an Active Directory domain. Why does this terminology persist? – Evan Anderson Oct 1 '09 at 22:33
Nobody saves to a floppy disk any more - why is the save icon still a floppy? Actually, the one that still shits me is when NEW GRADUATES talk about Class A/B/C IP ranges. WHAT THE HELL ARE YOU BEING TAUGHT???? – Mark Henderson Oct 1 '09 at 22:43
up vote 3 down vote accepted

If you're talking about the domain controller holding the PDC Emulator FSMO role I would strongly recommend running it on physical hardware. It's the master time sync source for the entire domain (and the entire forest, if in the forest root domain of a multi-domain forest). Clocks on virtual machines are notorious for drifting and time sync is pretty important since Active Directory bases authentication on Kerberos, which, in turn, has time sensitivity built-in (albeit you can configure it to be more "sloppy" if you really want to).

share|improve this answer
Thanks! Any gotchas on using the PDC (excuse me, "FSMO Role") also as a Hyper-V host? – Matias Nino Oct 2 '09 at 6:49
I'm not aware of any specific issues. Microsoft's recommended best practice is to keep a Hyper-V host free from any other "Roles", but it will probably work fine. – Evan Anderson Oct 2 '09 at 12:38

I tend to error on the side of caution, but I have HyperV servers running DCs all the time... The hypervisor is joined to the domain for convenience, but that is all...

share|improve this answer
In the past few years, the guidance from MS has changed and time sync has gotten better for guests in the major virtualization platforms. – mfinni Nov 5 '14 at 20:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.