Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I plan to create my first DC and forest on a physical server, then I want to run a second DC on a virtual server that will replicate the first DC. I understand that this will provide redundancy for AD that if the first domain controller went down the second would resume until the first is back online. Would this work and how?

share|improve this question
up vote 5 down vote accepted

Yes a DC on a virtual server will work fine, but obviously it needs to be on a different physical server to your first DC to see any benefit in resiliance.

In recent versions of windows there is no primary DC, however there are a number of FSMO roles which are assigned to 1 or more specific DCs. (by default your first)

When your main DC goes down the 2nd will have a replicated copy of your AD (very important) and will continue operating to some extent. If the main DC is down permanently then you can reassign the FSMO roles and carry on.

Quite a bit of the advice won't really apply to a single domain with 2 DCs but you can google for FSMO for a lot more info.

How things are effected by each of the roles with a DC failure

share|improve this answer
So if the FSMO roles are reassigned they would end in a virtualised environment (in my case) and I would have to rebuild the physical server. Ideally what I would like is one DC (physical) acting as the 'primary DC' and a second acting as a 'back-up DC'. In a sense they would share a copy of the AD and if one DC went down the other would just carry on! – stead1984 Nov 3 '09 at 14:24
@stead1984: That's exactly what will happen by default, unless as EK pointed out, you manually move FSMO roles. We run two virtual (on different boxes) DCs on our site and when one is down for maintenance, the other picks up no problem. The other benefit is that they will load share login requests,DNS and WINS requests (if configured) etc. – Scott Lundberg Nov 3 '09 at 23:45
yup, for short outages it will carry on as normal and you don't need to do anything. If you check the link it says what will break and what timescale you need to reassign or rebuild a server. – JamesRyan Nov 9 '09 at 10:02

To add another $0.02 ... Microsoft has some recommendations about virtualizing domain controllers you could search for. Big one is NEVER to restore a snapshot and suffer USN rollback.

share|improve this answer
This can be a serious applies equally to any restore of a previous version of AD when there are 1 or more current/live DCs running but the ease of using VM snapshots as "safety nets" over the last few years has resulted in this previously somewhat rare issue cropping up more frequently. – damorg Nov 3 '09 at 14:41

Here's a BIG thing to watch.

Make sure you don't snapshot / save state and restore later - As echobeach2 properly pointed out.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.