Windows 2003 functional level domain which includes... 2 windows 2008 Domain Controllers with integrated DNS serves, one of the 2 servers is a RODC. DHCP is giving our both IP address of DNS servers.

my question - how do I setup the DNS to roll over when one server is unavailable? Right now the first DNS server in the domain is acting like a master/primary. When I reboot the DC with the FMSO roles, (first DC), no one can log in and DNS goes completely down until the server comes back up.

My 2nd DC doesn't do anything i would expect.

Seems I remember that there is a setting that I can change to set a timeout of how long the first DC can be down before the 2nd DC will take over. Anyone remember anything like this?

It may be that I'm not following best practices at all, although I thought I was following them when it came to designing my AD and DNS.

Any ideas?


I would start with making sure the secondary domain controller's DNS server is answering DNS requests properly. Set the primary DNS on any client PC to the secondary DC, leaving the secondary DNS field blank, and see if you still can get online, ping addresses internal and external, etc.


What is the reason for the RODC?

You may want to read this article on RODC deployment

It says in part:

  • Service with the WAN offline

    When the WAN is offline, an RODC can authenticate only the users and resources for which it has cached passwords. If you have a strong requirement that any user must be able to authenticate in the branch office location, you may want to place a writable domain controller at that branch office location. As an alternative, you can place an RODC at the branch office location and configure the RODC so that all users’ credentials are allowed to replicate to it. You can then have an automated process in place that caches the credentials of the users, computers, and other resources that are located in the branch office. This way, you can take advantage of other RODC features. *

To me this implies if the writeable DC is serving up most logins, when it goes down the RODC will not have cached credentials and will be of no help. The RODC caches creds when it is asked to service a login and it talks to the writeable DC while doing so.

You can configure the RODC to replicate user credentials as well. That might help.

  • I actually miss-spoke. the 2nd server is server core. I'm putting in a RODC at the remote site I'm installing. – Phygg Dec 13 '10 at 23:05
  • My goal is to have a DC sitting there on the network in case my main DC goes down. My understanding was that you would always want a 2nd DC for redundancy. However, i never get the failover I want. – Phygg Dec 13 '10 at 23:07
  • Found this which discusses dns timeout: tech-archive.net/Archive/Windows/… – uSlackr Jan 4 '11 at 20:46

Almost every AD error is a DNS error.

A couple ideas:

  • I suggest you verify all the DNS entries for your AD servers.

  • Run 'ipconfig /registerdns' on the 2nd server.

  • To verify DNS on the second server, set the DNS for a client manually to the 2nd server to see if it works.

  • make sure DNS replication is working. The AD entries should be in both servers


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.