We have just setup our server (although I may be reinstalling it from scratch to use 2008 rather than 2003) and we are now looking into redundancy options. The best option I can see would be to have a duplicate server next to our current one which runs the domain aswell - we can then power off one of the servers for RAM upgrades etc. and the domain will continue to run as normal.

Is this functionality built in to Windows Server 2008? Also, we are using the server as a file server aswell as the domain controller - would this be duplicated across the two servers aswell?

So basically my questions are:

How easy would it be to setup a continuously duplicated server next to our current server? Would we just need another server license for 2008, or another CAL license for each device?



  • If you're running both simultaneously, you'll need two sets of licences. As for real-time replication, it's possible but probably expensive. If one is just a backup server which comes online when the other is down, you may be able to get around the licencing issue, but then surely you want a cluster in that scenario anyway? – user3914 Oct 3 '10 at 9:36
  • It's simply (in theory) just to enable the domain to remain usable whilst one of the servers is turned off for upgrades etc. A nightly backup would be sufficient - I am thinking moving the files to a dedicated server would be a good idea. Then the two DC servers would only have to worry about users logging in etc. – dannymcc Oct 3 '10 at 10:04
  • 1
    Domain Controllers being on separate boxes doing nothing but Domain Controlling (please excuse that, I can't think of a better phrase :/) is indeed the recommended way of doing it. – Ben Pilbrow Oct 3 '10 at 10:37

I absolutely agree that the best way to handle this is to simply create another domain controller. Domain services, DNS, etc, will all work fine - very well - with an extra DC. They replicate to each other and if one goes down, no problem.

You will want to make sure that all clients have the primary DC as one of their configured DNS servers (either via static config or DHCP). You also want to make sure that you do not run DHCP on both servers (unless you give them separate scopes) so they don't run into each other. You can of course configure DHCP identically on both boxes and just make sure you start DHCP on the "takeover" box when the primary is down for maintenance, and vice versa.

Finally for high availability of file shares you could look at Windows DFS, which will sync file shares across multiple servers. This is not a backup - if you delete a file on server 1 it gets deleted off server 2 - but it would keep the file contents in synch between both servers. Note that this will NOT (i don't think) automatically transfer a user's connection to a different server - so if a user has a file open on server1 and server1 goes down, the user can access the file on server2, but I believe the user will have to re-open the file.

What I would recommend in this scenario is two domain controllers and putting the file shares on a 3rd server or a NAS. That way, rebooting the DCs doesn't affect file access at all. And, best practice dictates that DCs should only be DCs - no other roles/services running on them.

| improve this answer | |
  • Thanks for the in depth response. I am coming to the conclusion 3 servers is the ideal setup. Two for domain controllers and one for files as you suggest. The frustrating part is that we could justify the cost of the servers, but the licenses are really crippling to budgets! – dannymcc Oct 4 '10 at 18:01
  • Just a suggestion, if you only need the 3rd server for NAS, look at FreeNAS or OpenFiler rather than adding the cost of another Windows server (license) into the mix. Both of these will authenticate against your active directory setup, and as FOSS projects are free. We use several FreeNAS servers, some of them as VMs, in our AD environment and are quite happy with them. – nedm Oct 4 '10 at 18:12

You don't need a second client license to run against more than one Windows 2008 server, but you do need another server license for the second server itself.

It sounds like you're simply wanting to set up what used to be referred to as a Backup Domain Controller (back in the Windows NT 4.0 days-- 1999 and before) and is now called installing an additional domain controller (since domain controllers are equal peers and there's no longer a concept of "primary" and "backup"). When you install Windows 2008 on the first computer, you'll want to create a new Active Directory Domain if you don't currently have one, and set it as a Domain Controller. When you install the second server, you'll want to set it to be a DC as well. They will replicate user and computer accounts, Group Policies, and other things in the AD store between them. If you want redundancy such that either can "run" the domain, you'll want DNS servers on both of them, as well. Make the second DC uses the first one for its primary DNS server in the network settings, and have the first DC set to its own IP to avoid ending up with 2 separate (and potentially conflicting) sets of DNS entries, and have both DNS servers recursively query an outside DNS server, such as Google, OpenDNS, or the servers assigned to you by your ISP, if they don't find the address on your network. Be sure to set these 2 as the DNS Servers for your clients in their network properties as well.

Lastly, with regard to file shares on Windows, real-time duplication is more expensive and complicated, but possible with things like clustering. However, if real-time isn't critical, there are many ways to copy data between hosts -- robocopy is a good and efficent program for doing this.

| improve this answer | |
  • Great, that answers my questions perfectly. Thanks! – dannymcc Oct 3 '10 at 9:52
  • Added some clarification re: "Backup Domain Controller" since we're partying like it's 2010 now, and not 1999. – Evan Anderson Oct 3 '10 at 19:42
  • 1
    +1, but with one addendum - I wouldn't bother with DNS forwarding to Google, rather just let it use the Root Hints and don't rely on anyone else's DNS resolver but your own. – Mark Henderson Oct 3 '10 at 20:11

I presume it's a physical server not a VM?

Ideally you want at least two domain controllers, and ideally you want them on separate metal (better yet in different locations).

You can do replication with the tools built into Windows such as DFS-R, but it is replication/distribution it won't help you much if someone hits delete when they shouldn't do as all it'll do is replicate the deletion.

So the short answer is that to have a backup domain controller, and a second copy of your file data is pretty cheap/simple, but to have it all continuously available with no downtime if you want to upgrade one box isn't so cheap and simple.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.