A domain controller is a server in a Microsoft Active Directory or NT4 domain that is responsible for central authentication.

learn more… | top users | synonyms (1)

27
votes
7answers
4k views

Is it best practices to have separate login for a domain for domain admins?

I typically like to set up separate logins for myself, one with regular user permissions, and a separate one for administrative tasks. For example, if the domain was XXXX, I'd set up a XXXX\bpeikes ...
19
votes
3answers
2k views

“Peaky” CPU Usage on Domain Controllers

We have two Windows Server 2008 SP2 (sadly not 2008 R2) Domain Controllers in a small 150 client domain that are exhibiting very "peaky" CPU usage. The Domain Controllers both exhibit the same ...
15
votes
1answer
16k views

What needs to be done after a Domain Controller crash?

Assuming that at least two domain controllers were present in the domain to start with, what steps need to be taken to make Active Directory healthy after a domain controller crash?
14
votes
3answers
13k views

What should the order of DNS servers be for an AD Domain Controller and Why?

This is a Canonical Question about Active Directory DNS Settings. Related: What is Active Directory and how does it work? Assuming an environment with multiple domain controllers ...
14
votes
1answer
283 views

Group Policy Result summary says DC is member of “BUILTIN\Administrators”

Whenever I run the Group Policy Result wizard and select a Domain Controller as the target computer, the summary shows BUILTIN\Administrators in the list of "Security Group Membership when Group ...
13
votes
3answers
1k views

Why can I login to a box even if the AD Domain controller is down?

Scenario: While my DC is running, I log into an arbitrary machine. I stop the DC I log off the arbitrary machine. Let's bounce it for good measure, too. When the machine comes back up, I can still ...
13
votes
1answer
1k views

Domain Administrators account policy (After PCI audit)

One of our clients is a Tier 1 PCI company, and their auditors have made a suggestion with regards to us as System Administrators and our access rights. We administer their entirely Windows based ...
13
votes
1answer
126 views

What does “DEL:” mean in the DistinguishedName of an AD Object?

Sorry -- I'm not really a Windows System Admin, just trying to slam through some LDAP interactions in Java. I'm finding a ton of objects with "DEL:" in the distinguishedName. Are these orphaned ...
12
votes
3answers
13k views

Seizing FSMO roles from dead Windows Domain Controller

I've seen other questions and documents about doing this, but there are some things that still confuse me. Here are the documents and questions I've seen: Retire a Dead Windows 2003 Domain ...
11
votes
8answers
19k views

What's a read-only domain controller actually useful for?

Windows Server 2008 introduced read-only domain controllers, which receive a full replica of the domain database but can't modify it, just like a good old Windows NT BDC. I know all the technical ins ...
11
votes
5answers
7k views

Replacing a W2K3 Domain Controller - what do I need to know?

I have a network of around 70 machines, currently with two DCs both running Windows Server 2003 (DC0 & DC1). DC0 is a five year old Poweredge 1850 and has recently become increasingly flakey, and ...
10
votes
2answers
3k views

Sharing Domain name between domain controller and webserver

In our network the name of the network domain is also the domain of the organisation's website (say, example.com). Externally people can enter example.com to visit our website but internally this ...
9
votes
7answers
11k views

Can a Linux server serve as a Domain Controller for Windows Machines?

In a small office setup (5-6 employees) we have seven Windows XP and Windows Vista clients, as well as a couple of linux servers. Is it possible to set up a linux machine to act as the domain ...
9
votes
2answers
695 views

Demoted domain controller still authenticating users

Why is a demoted domain controller still authenticating users? Whenever users log onto workstations with domain accounts, this demoted DC authenticates them. Its security log shows their logons, ...
8
votes
2answers
3k views

Moving primary domain controller to new server

I have just purchased a new server that will be the new primary domain controller. I was wondering if anyone knew any articles or tutorials on how to do this change over? I would imagine it is just ...
8
votes
2answers
827 views

Domain Controller offline for a few days

My primary domain controller died over the weekend, its motherboard is being replaced tomorrow. I have been told that the mac address of the server may change once the new motherboard is installed. ...
8
votes
1answer
279 views

Why would a domain controller encouter a USN rollback after an unclean shutdown?

I have this Windows Server 2008 R2 domain controller running on a physical Dell server, model PowerEdge R510. There are some electrical problems around here, thus a black-out is, unfortunately, quite ...
7
votes
3answers
339 views

Can a Second Domain Controller, with buggy hard drive hardware, cause a corruption to Active Directory?

We have a new Domain Controller that holds all FSMO roles. We also have two old hardware servers, about 4-5 years old each, set up as secondary Domain Controllers (or better described as Domain ...
7
votes
3answers
39k views

What is a domain controller, when is it needed, and how to set it up?

I would like to know what do we mean by Domain controller and how do we make a system a Domain Controller and when do we have to make a system a DC?
7
votes
2answers
370 views

How can I save a domain controller after a USN rollback without rebuilding the whole server?

Today I had (again...) to lobotomize a domain controller which had suffered the dreaded USN rollback; the standard solution to this issue is to demote it and then promote it back again, but the main ...
7
votes
3answers
2k views

Need for another Domain Controller

I have two domain controllers (Windows 2003) in one site where most of the department I support resides. There is another building (at another site) where my department resides as well, but they have ...
7
votes
3answers
1k views

Advice on Active Directory design for multihomed servers

I've been tasked by a customer to come up with a working Active Directory design for a scenario with the following requirements (simplified, they are actually a lot worse): There is a subnet for ...
6
votes
3answers
2k views

Number of Domain Controllers needed?

In the process of migrating 7 school site network from Server 2003/XP to Server 2012/7 and wanted to get some feedback on how many domain controllers would be optimal. Currently we have 4 DCs. All 7 ...
6
votes
2answers
1k views

Use Google Apps/Cloud Services as a Domain Controller Replacement

This is a Canonical Question about Cloud Services replacing Active Directory. Is it possible to use Google Apps or another Cloud Service as a replacement for a Windows Domain Controller ...
6
votes
5answers
222 views

Problem when trying to change to a different DNS source for Active Directory

This may be a completely stupid question, but I'm really new to Windows Server 2003. If this is something I should be able to figure out on my own, just point me in the right direction. I have no idea ...
6
votes
2answers
8k views

Force Windows server to use specific Domain Controller

Is there a way I can set an OWA server in my DMZ to talk to a DC in the local site? The DMZ is located at the same (physical) site as a LAN with DCs on it. (There is no DC in the DMZ.) Can I force ...
6
votes
8answers
2k views

Renaming a windows 2003 domain?

we currently have an office server running on Windows 2003. The server hosts e-mail (exchange) and active directory. Also we have two client pc's which get their internet connection and their profiles ...
6
votes
1answer
3k views

Procedure for rebooting Domain Controllers?

We have several servers running as Domain Controllers, "DC01", "DC02", and "DC03". For some reasons, we need to reboot them. Is there a specific procedure to follow? Additional info: "DC01" ...
6
votes
3answers
4k views

Domain Controller thinks its on a Public Network

We have a Server 2008 R2 Primary Domain Controller that seems to have amnesia when it comes to working out what kind of network it is on. The (only) network connection is identified at startup as a ...
6
votes
1answer
705 views

Migrating Server 2003 -> Server 2008 r2. Global Catalog location. DNS problems

I've got a dying server with a WinServer 2003 installed. It's a Domain Controller. I've made a virtual machine with a Server 2008 r2 and migrated all roles on it. But there is a problem. Global ...
6
votes
4answers
2k views

Unable to dcpromo new 2008 Server in 2000 domain

I'm trying to replace an old Windows 2000 domain controller with a new Windows 2008 Server. I have the Active Directory Domain Services role installed on the new server and joined it to the domain. ...
6
votes
3answers
5k views

Two Different Domains & Domain Controllers on Single Network

I'm attempting to determine whether it is possible to have two Active Directory domain controllers running on the same network, within the same subnet, with two separate domains. I do not want these ...
6
votes
1answer
196 views

Active Directory Country capitals (letters)

Does someone know how to solve the problem of changing all country fields at once and probably why the country field is multiplied each time I select + apply a country change until the Object is being ...
6
votes
2answers
76 views

Setting up a Windows Domain in a O365-only company

My company is quite young and small, but since we're growing, we want to rollout some software deployment solution. We haven’t decided which one yet, but they usually need a Windows Domain, and we ...
6
votes
1answer
88 views

repetitive errors on user machines - DC migration from a windows XP based to a windows 7 based network

I'm replacing all the old windows XP machines in my network to new machines running windows 7. I hoped it would be an easy task, but apparently it isn't: all the machines I've installed (using WDS) ...
6
votes
2answers
258 views

Adding a Win 2008 R2 DC to a Win 2000 Server domain

I am in the process of moving our active directory environment off of Windows 2000 server to a new Windows 2008 R2 server. I have prepped our Windows 2000 domain and upgraded the schema so that I ...
5
votes
3answers
325 views

What are the drawbacks of making all of my windows servers domain controllers?

As the question states, what are the drawbacks of making every capable Windows 2003 or 2008 Server in my organization a domain controller for the domain? Is it just overkill? Will many 3rd party ...
5
votes
8answers
44k views

How to tell what time a domain user logged in?

In the "Security" event log on a Windows 2003 domain controller, I see several entries of event 540 -- "Successful Network Logon" averaging a few minutes apart throughout the day. Is the first one of ...
5
votes
4answers
2k views

Risks of having only one domain controller

Are there any risks besides downtimes, if there is only a single domain controller for a small company? I did some research and everyone recommends at least two domain controllers, but I can't find a ...
5
votes
3answers
3k views

What can go wrong when Domain Controllers have been moved out of Domain Controller OU?

I administer a network with Server 2003 domain controllers. I am planning to replace the domain controllers with new Server 2008 DC's. When running DCDIAG, I receive an error that the domain ...
5
votes
3answers
342 views

What should I do if a domain controller/DNS/etc. machine is stolen?

Let's say I have a Windows 2008 (or a Windows 2003) Domain Controller (With DNS, etc.) in a remote office that is (of course) part of a much larger domain in a primary location (it's in a separate ...
5
votes
3answers
70 views

Identify applications that are configured to connect to a specific domain controller

I work with a Windows domain that has many domain controllers (DCs). I'm looking to remove some of these, but I know there are some applications that are hard-coded to use a specific domain controller ...
5
votes
5answers
3k views

Computer cannot obtain the domain controller name

We installed a few new computers to the network, and all of them appear to be having the same issue in Application Event Log: Windows cannot obtain the domain controller name for your computer ...
5
votes
1answer
19k views

Can't access some clients using w32tm /stripchart - error: 0x800705B4

I'm trying to track down a time synchronisation problem. I've got a DC in a remote branch. w32tm /dumpreg /subkey:Parameters reveals Type = NT5DS and the Type means its sync'ing with the domain, I ...
4
votes
3answers
4k views

When should you create additional domain in forest?

My company is opening a new site in a different country. We will be installing new servers there and I have a question I can't decide on. Should we create a new domain in the forest or should we just ...
4
votes
4answers
10k views

Internal and External DNS from Different Servers, Same Zone

I am either having trouble understanding how DNS works, or I am having trouble configuring my DNS correctly (either one isn't good). I am currently working with a domain, I'll call it webdomain.com, ...
4
votes
4answers
1k views

DHCP in Windows 2003/2008 DC or in Router?

For a small Active Directory managed network (say 30-50 DHCP clients) should I have a domain controller (and then somehow another one as a failover) hand out IPs via DHCP or should I just let my ...
4
votes
3answers
891 views

Domain computers with no specific user?

We have a Windows Server 2008R2 server which is running our domain. We have around 40 users and around 30 computers. Most of the users have their own dedicated workstation, however around 5 of the ...
4
votes
2answers
588 views

Two trusted domains with same username in both - can we merge?

We have 2 domains (A,B) in our environment. Whenever someone joins the company, his account will be created in domain A. If someone has to work in a particular department, an account will be created ...
4
votes
3answers
513 views

If I join esxi to an Active Directory domain, how does it choose which DC to authenticate to?

I'm familiar to vSphere and large installations, and not at all familiar with the free products. Topology & configuration We have some branch offices that use ESXi and have a DC resident on ...