A domain controller is a server in a Microsoft Active Directory or NT4 domain that is responsible for central authentication.

learn more… | top users | synonyms (1)

30
votes
7answers
15k views

Is it best practices to have separate login for a domain for domain admins?

I typically like to set up separate logins for myself, one with regular user permissions, and a separate one for administrative tasks. For example, if the domain was XXXX, I'd set up a XXXX\bpeikes ...
24
votes
3answers
46k views

What should the order of DNS servers be for an AD Domain Controller and Why?

This is a Canonical Question about Active Directory DNS Settings. Related: What is Active Directory and how does it work? Assuming an environment with multiple domain controllers (...
22
votes
6answers
2k views

What causes a workstation to lose trust with the domain controller?

I've received the error several times on Windows 7 Workstations and Laptops where it loses trust with the domain controller, and I know how to fix it, but why does it do that?
22
votes
4answers
9k views

“Peaky” CPU Usage on Domain Controllers

We have two Windows Server 2008 SP2 (sadly not 2008 R2) Domain Controllers in a small 150 client domain that are exhibiting very "peaky" CPU usage. The Domain Controllers both exhibit the same ...
17
votes
1answer
23k views

What needs to be done after a Domain Controller crash?

Assuming that at least two domain controllers were present in the domain to start with, what steps need to be taken to make Active Directory healthy after a domain controller crash?
17
votes
8answers
26k views

What's a read-only domain controller actually useful for?

Windows Server 2008 introduced read-only domain controllers, which receive a full replica of the domain database but can't modify it, just like a good old Windows NT BDC. I know all the technical ins ...
16
votes
6answers
44k views

Domain Controller thinks its on a Public Network

We have a Server 2008 R2 Primary Domain Controller that seems to have amnesia when it comes to working out what kind of network it is on. The (only) network connection is identified at startup as a '...
15
votes
3answers
3k views

Why can I login to a box even if the AD Domain controller is down?

Scenario: While my DC is running, I log into an arbitrary machine. I stop the DC I log off the arbitrary machine. Let's bounce it for good measure, too. When the machine comes back up, I can still ...
14
votes
1answer
600 views

Are all domain controllers on a small network considered equivalent/equal?

Windows Server 2012 R2 w/ GUI, Hyper-V host, VM DC I am installing my first second Domain Controller(DC) (sounds weird but that really is what I'm doing). I have what I think is a good process to ...
14
votes
1answer
2k views

Domain Administrators account policy (After PCI audit)

One of our clients is a Tier 1 PCI company, and their auditors have made a suggestion with regards to us as System Administrators and our access rights. We administer their entirely Windows based ...
14
votes
1answer
370 views

Group Policy Result summary says DC is member of “BUILTIN\Administrators”

Whenever I run the Group Policy Result wizard and select a Domain Controller as the target computer, the summary shows BUILTIN\Administrators in the list of "Security Group Membership when Group ...
13
votes
4answers
4k views

How bad is it to run Exchange 2016 on a Windows 2012 R2 domain controller for a small organization with assuredly fewer than 25 users?

I know that it has been officially unsupported forever and yet I have seen or heard about many small business installations of a single host running AD DS and Exchange simultaneously. For a resource-...
13
votes
3answers
31k views

Seizing FSMO roles from dead Windows Domain Controller

I've seen other questions and documents about doing this, but there are some things that still confuse me. Here are the documents and questions I've seen: Retire a Dead Windows 2003 Domain ...
13
votes
1answer
145 views

What does “DEL:” mean in the DistinguishedName of an AD Object?

Sorry -- I'm not really a Windows System Admin, just trying to slam through some LDAP interactions in Java. I'm finding a ton of objects with "DEL:" in the distinguishedName. Are these orphaned ...
11
votes
4answers
54k views

What is a domain controller, when is it needed, and how to set it up?

I would like to know what do we mean by Domain controller and how do we make a system a Domain Controller and when do we have to make a system a DC?
11
votes
5answers
8k views

Replacing a W2K3 Domain Controller - what do I need to know?

I have a network of around 70 machines, currently with two DCs both running Windows Server 2003 (DC0 & DC1). DC0 is a five year old Poweredge 1850 and has recently become increasingly flakey, and ...
10
votes
1answer
586 views

In a multi-domain forest, what EXACTLY happens when some, but not all, of the Infrastructure Masters are on Global Catalogs?

There are plenty of TechNet articles, like this one that say that phantom object don't get updated if an Infrastructure Master is also a Global Catalog, but other than that there isn't a lot of in ...
9
votes
7answers
12k views

Can a Linux server serve as a Domain Controller for Windows Machines?

In a small office setup (5-6 employees) we have seven Windows XP and Windows Vista clients, as well as a couple of linux servers. Is it possible to set up a linux machine to act as the domain ...
9
votes
2answers
3k views

Domain Controller offline for a few days

My primary domain controller died over the weekend, its motherboard is being replaced tomorrow. I have been told that the mac address of the server may change once the new motherboard is installed. ...
9
votes
2answers
2k views

Demoted domain controller still authenticating users

Why is a demoted domain controller still authenticating users? Whenever users log onto workstations with domain accounts, this demoted DC authenticates them. Its security log shows their logons, ...
8
votes
2answers
15k views

Moving primary domain controller to new server

I have just purchased a new server that will be the new primary domain controller. I was wondering if anyone knew any articles or tutorials on how to do this change over? I would imagine it is just ...
8
votes
2answers
16k views

Force Windows server to use specific Domain Controller

Is there a way I can set an OWA server in my DMZ to talk to a DC in the local site? The DMZ is located at the same (physical) site as a LAN with DCs on it. (There is no DC in the DMZ.) Can I force ...
8
votes
3answers
7k views

Server 2012 R2 Active Directory Domain SRV dns records suddenly disappeared

I have a test domain that I recently configured. All of a sudden, no users can log in except those with cached credentials. The domain includes two domain controllers that are both global catalogs ...
8
votes
4answers
10k views

Two Different Domains & Domain Controllers on Single Network

I'm attempting to determine whether it is possible to have two Active Directory domain controllers running on the same network, within the same subnet, with two separate domains. I do not want these ...
8
votes
4answers
39k views

Hyper-V Time Sync for VM Domain Controller

We have 2 physical hyper-V servers running 8 VMs between them, each physical server has a Domain controller on it running in a VM and all servers are 2008R2 The VM PDC is set to NTP and to sync with ...
8
votes
5answers
16k views

Can an LDAP query on AD provide the netbios domain name for a single account when using the Global Catalog?

I am using ADSI Edit to look at LDAP properties of a single user account in AD. I see properties such as userPrincipalName, but I do not see one for the fully qualified domain name (FQDN) or the ...
8
votes
3answers
3k views

Advice on Active Directory design for multihomed servers

I've been tasked by a customer to come up with a working Active Directory design for a scenario with the following requirements (simplified, they are actually a lot worse): There is a subnet for ...
8
votes
1answer
566 views

Why would a domain controller encouter a USN rollback after an unclean shutdown?

I have this Windows Server 2008 R2 domain controller running on a physical Dell server, model PowerEdge R510. There are some electrical problems around here, thus a black-out is, unfortunately, quite ...
8
votes
1answer
543 views

AD Replica DC Promotion Stall

I recently inherited infrastructure duties for a small startup I am working with. My traditional role has been development, so bear with me... I was hoping to start off on the right foot, and get ...
7
votes
2answers
2k views

Use Google Apps/Cloud Services as a Domain Controller Replacement

This is a Canonical Question about Cloud Services replacing Active Directory. Is it possible to use Google Apps or another Cloud Service as a replacement for a Windows Domain Controller (replacing ...
7
votes
8answers
67k views

How to tell what time a domain user logged in?

In the "Security" event log on a Windows 2003 domain controller, I see several entries of event 540 -- "Successful Network Logon" averaging a few minutes apart throughout the day. Is the first one of ...
7
votes
3answers
362 views

Can a Second Domain Controller, with buggy hard drive hardware, cause a corruption to Active Directory?

We have a new Domain Controller that holds all FSMO roles. We also have two old hardware servers, about 4-5 years old each, set up as secondary Domain Controllers (or better described as Domain ...
7
votes
1answer
18k views

Why are there no local users and groups on Windows 2K3/2K8 domain controllers?

MS have taken great pains to remove 'Local Users and Groups' from the GUI tools, and even if you tickle up lusrmgr.msc directly it complains that the snap-in won't run on a domain controller. The ...
7
votes
2answers
907 views

How can I save a domain controller after a USN rollback without rebuilding the whole server?

Today I had (again...) to lobotomize a domain controller which had suffered the dreaded USN rollback; the standard solution to this issue is to demote it and then promote it back again, but the main ...
7
votes
3answers
2k views

Need for another Domain Controller

I have two domain controllers (Windows 2003) in one site where most of the department I support resides. There is another building (at another site) where my department resides as well, but they have ...
7
votes
4answers
3k views

Unable to dcpromo new 2008 Server in 2000 domain

I'm trying to replace an old Windows 2000 domain controller with a new Windows 2008 Server. I have the Active Directory Domain Services role installed on the new server and joined it to the domain. ...
7
votes
1answer
20k views

Which firewall ports do I need to open in order for a domain trust to work?

I have two Active Directory domains in two different forests; each domain has two DCs (all of them Windows Server 2008 R2). The domains are also in different networks, with a firewall connecting them. ...
7
votes
2answers
106 views

Delay Windows (member) Server start-up until Domain Controller is available

What is the most efficient way do delay (or pause) the cold start-up of Windows domain member servers until a domain server is available? There are ways to delay the start-up of a server , but it is a ...
6
votes
3answers
4k views

Number of Domain Controllers needed?

In the process of migrating 7 school site network from Server 2003/XP to Server 2012/7 and wanted to get some feedback on how many domain controllers would be optimal. Currently we have 4 DCs. All 7 ...
6
votes
5answers
225 views

Problem when trying to change to a different DNS source for Active Directory

This may be a completely stupid question, but I'm really new to Windows Server 2003. If this is something I should be able to figure out on my own, just point me in the right direction. I have no idea ...
6
votes
2answers
12k views

When should you create additional domain in forest?

My company is opening a new site in a different country. We will be installing new servers there and I have a question I can't decide on. Should we create a new domain in the forest or should we just ...
6
votes
3answers
15k views

How to temporarily stop time syncing with domain controller?

I wish to do some testing on my local machine which requires me to put the date forward a year. So I can test some stuff in SQL Server (i've found it not possible to override the sql server time). ...
6
votes
2answers
25k views

How do Windows domain clients behave if the DC is offline?

I'm really new to domain administration and I'm trying to learn the what-ifs. If I have Windows clients that are connected to a DC and the DC goes offline, what kind of behavior can I expect with the ...
6
votes
1answer
7k views

Procedure for rebooting Domain Controllers?

We have several servers running as Domain Controllers, "DC01", "DC02", and "DC03". For some reasons, we need to reboot them. Is there a specific procedure to follow? Additional info: "DC01" ...
6
votes
4answers
3k views

Risks of having only one domain controller

Are there any risks besides downtimes, if there is only a single domain controller for a small company? I did some research and everyone recommends at least two domain controllers, but I can't find a ...
6
votes
8answers
2k views

Renaming a windows 2003 domain?

we currently have an office server running on Windows 2003. The server hosts e-mail (exchange) and active directory. Also we have two client pc's which get their internet connection and their profiles ...
6
votes
1answer
1k views

Migrating Server 2003 -> Server 2008 r2. Global Catalog location. DNS problems

I've got a dying server with a WinServer 2003 installed. It's a Domain Controller. I've made a virtual machine with a Server 2008 r2 and migrated all roles on it. But there is a problem. Global ...
6
votes
3answers
10k views

hyper-v server time sync source - PDC / external NTP?

The environement: 10 Hyper-V hosts, all AD joined a lot of VMs AD joined and some not some AD DCs including PDC as Guests What You think is the best approach to time sync a hyper-v farm with AD ...
6
votes
1answer
4k views

Error adding child Active Directory domain to existing forest

I'm building a test environment containing multiple Active Directory domains in the same forest, but I'm having strange issues while trying to add a child domain to the forest root domain. All ...
6
votes
1answer
665 views

Active Directory Country capitals (letters)

Does someone know how to solve the problem of changing all country fields at once and probably why the country field is multiplied each time I select + apply a country change until the Object is being ...