Is there a way to reliably keep Windows Server domain member servers talking to domain controllers on Amazon EC2 if the instances are stopped/started?

We have a number of testing servers on EC2 that are joined to Active Directory domains. Right now the way I have these working is that they all belong to the same security group, and then I have the DNS Server on each member server set to the Amazon-DHCP assigned internal IP address of the domain controller.

The issue here is that if you stop the domain controller and start it back up, the system does not necessarily receive it's old DHCP-assigned IP Address lease, and receives a new IP (understandably so) In turn, the member servers have no idea how to find the Active Directory domain as name resolution fails.

Setting up an elastic IP for the domain controller, then setting the DNS server to that value does not work, as my understanding is traffic functionally goes "outside" and then back "inside" as it traverses the public IP, and thus I'd need massive ranges of ports opened up on the security group (bad idea I think ...)

Is there any kind of way that a system can find another EC2 instance (by instance ID), then set your instance's DNS Server to that other instances current internal IP Address, or another method by which my Active Directory communication can persist across instance starts/stops?


I've not done this in EC2 but is there no way to reserve a private IP? The key here is to focus on a way for the server to get the same IP. It's not a AD DC issue, it's a DNS server issue. DNS servers by their very nature should not change IP's. Technically if you had DNS on one box with static IP and AD DC on another box (without DNS Server on it) then the AD DC could be dynamic, as it would DDNS to the DNS server on boot just like member servers and change the DNS records for itself.

  • As far as I can tell, there is no way to reserve private IP's. They are Amazon DHCP-issued. If you try to set your own, they just don't seem to route. Your scenario of the DNS server being independent is a good idea, but unfortunately that's +1 for another instance and adds to the cost. But, keeping a small sized 2003 DNS instance online while the other's are shut off, the stopped state of the other instances would pay for the small instance. Ideally I'd like something that allows the instances to be completely stopped however, without additional infrastructure – Jay Teal Mar 17 '11 at 14:59
  • Unless you have thousands of users and hundreds of computers using AD DC constantly (or something like a large Exchange system), you should be able to handle DNS and Domain Controller functionality on a small instance with no problem. Sigh.., if only the small instance was x64 compatible, I'd recommend taking your DC to Server 2008 R2 which would run even better on that small instance. Domain Controllers and DNS are almost always over provisioned in networks as they use very little resources on modest networks. – Bret Fisher Mar 17 '11 at 15:20
  • Have a look at this amazon blog post aws.typepad.com/aws/2011/03/…. Looks like you can now set up you're own Virtual Private Network in the cloud now. And even point it back to your company dns. Might help solve this issue. – Decado Mar 18 '11 at 7:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.