Today we suffered from a hard drive failure on an old server that was acting as a domain controller (Windows Server 2008). It was also sharing our printers and acting as a DNS server. Luckily, all the user files and folders were on a seperate server that's backed up to an external hard drive.

As a side project of mine I have been gradually learning more about virtualisation. So now that I have got to rebuild our domain controller I wondered if it was a good time to move the DC to a virtual machine.

We now have the following servers:

  • HP ProLiant DL360 G4 3.0GHz Xeon 4GB RAM. 73GB HDD. x3
  • HP ProLiant DL360 G4 2.4GHz 3GB RAM. 292GB HDD
  • HP ProLiant ML110 G6 3.0GHz 8GB RAM. 250GB HDD

Currently the three DL360's have VMware ESXI 4.1 installed and the ML110 is the domain file server which is also running VMware vCenter server.

Currently the only VM's that are in use are a couple of Windows XP machines that I converted to virtual machines as a test case.

We have ~35 workstations all running Windows XP Pro SP3, 2 LAN Printers and a seperate server that's maintained by an outside contractor.

The biggest issue with the domain has always been that users log in for about 2 minutes then move to another workstation (we are an animal hospital with nurses and vets all moving around the building), because of this the login time is almost always too long in the users opinion. To be fair 30 seconds does seem like a long time when there is a sick animal waiting on their attention!

So my question(s);

  1. Would you stick with a domain or downgrade to a workgroup?
  2. How would you use the hardware available if using a domain?
  3. Anything glaringly obvious that will cause problems that I may have missed in relation to the hardware and VMware vSphere?
  1. Yeah, AD rocks for policy, security, and a whole slew of other benefits.
  2. I'm partial to another virtualization platform; but ESXi works great; sounds like a good setup to me.
  3. Might consider using thin clients instead of full workstation, and a terminal server (or two or three) backing them. Login time would be almost eliminated as they move around (their session would simply be redirect to the new thin client).

    Terminal Servers can be virtualized, and depending on what you're trying to accomplish exactly, VDI might be a better way to go (each user gets a VM with XP or Win7, a Terminal Server Gateway takes care of connecting the right user the to right VM).

    MS even recently released a version of Windows just for turning old PCs into thin clients (so you don't have to buy new hardware until you want to). Though your DL380s are somewhat lacking in RAM, which would have to be remedied before going with Terminal Services.

    If you're not familiar with Termainal Services (requirements, licensing, and benefits) you might want to get a consultant involved who can look at your situation more closely. It's a bit of a leap to make for a company your size, but the user experience and productivity benefits might easily make up for the costs.

  • So do thin clients just have an RDP client and nothing else? Is it better to have 35 virtual machines and give each employee their own computer or use terminal services? – dannymcc Jul 7 '11 at 19:12
  • That's the basic idea of a Thin Client, though they do have some other capabilities. The second question is impossible for me to answer without knowing a lot more about your use case. – Chris S Jul 7 '11 at 19:13
  • Presumably the thin client just needs the user/pass rather than the user entering the ip every time. I think I've answered my second question myself! – dannymcc Jul 7 '11 at 19:15
  • I'm partial to VMWare ESX/ESXi myself, but if you're an MS shop I would definitely evaluate Hyper-V, Microsoft's (free!) bare-metal hypervisor that competes in the same space as VMWare. You already have VMWare infrastructure though, so it may make sense to stick with that. – voretaq7 Jul 7 '11 at 19:16
  • @Dannymcc, yep, or you could use smart cards, usb tokens, fingerprints (lots of ways to authenticate; most cost more than username/password however). The Thin Clients are typically setup to only connect to a single server, so the user never has to think about it. Though again, there's a lot of options here; if one thing doesn't work well for you, there's probably an alternative. – Chris S Jul 7 '11 at 19:19

There are a lot of considerations when virtualizing domain controllers:

Things to consider when you host Active Directory domain controllers in virtual hosting environments

Planning to Virtualize Domain Controllers

Deployment Considerations for Virtualized Domain Controllers

Operational Considerations for Virtualized Domain Controllers

Backup and Restore Considerations for Virtualized Domain Controllers


I would suggest the Domain Controller remain a separate, physical box. AD will be much simpler for management. If the DC is a VM, I have seen issues around other services not starting or systems having issues because they cannot reach the DC in a timely manner. If the DC always boots and all servcies satrt fierst, maybe not an issue.

You do not mention the drive config on the servers Is there just one drive on the DL360 with 3GB of RAM? RAID on any? If running multiple VMs you want to avoid RAID 5.

VMs are great but make sure you have a backup process in so you can recover quickly. Drives are pretty inexpensive so full copies are easy to store.

Also worth looking at this MS doc Things to consider when you host Active Directory domain controllers in virtual hosting environments

  • 1
    If you're running a DC as a VM and you experience performance problems, it's not due to the virtualization in and of itself. Rather, it's due to improper resource scaling. We run three domain controllers at our main site, all on top of ESXi 4.1, serving anywhere from 1000 to 4000 people per day (depending on whether or not school is in session). We scale things properly and have never once had a performance problem. – EEAA Jul 7 '11 at 19:24
  • I take your point on the DC being a dedicated box. The drive configs are simple 1 HDD per DL360 with the DL380 having 4 drives which are currently set to RAID 5 but I have literally only today installed open filer and haven't tried it yet. What raid setup would you suggest? – dannymcc Jul 7 '11 at 19:25
  • @dannymcc - you probably didn't see my comment before posting yours. Please, ignore Dave's suggestion to make sure your DCs are not virtualized. – EEAA Jul 7 '11 at 19:26
  • Yep, didn't see it! Out of interest do you use a data store that's local to the VM or a seperate SAN? – dannymcc Jul 7 '11 at 19:30
  • @dannymcc - all of our vmfs volumes are either on FC or iSCSI connected SAN volumes. All of the backing SAN volumes are RAID10. – EEAA Jul 7 '11 at 19:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.