The basic question is this: what issues might I encounter if I have an existing Exchange 2010 server and I install the domain controller role on it? This is a small organization (<10 people).

For background as to why I need to do this...

Our network currently has a single domain controller and a single Exchange server that fills all Exchange roles. Bear in mind that I realize that this is not an ideal setup (we should have an additional DC and should have our internal Exchange roles on a different server from the external roles), but with the size of our organization it's very difficult to justify purchasing additional hardware.

Our current online backup solutions (two of the big names; no need to mention them here) support backing up Active Directory data as well as the Exchange database, but in order to do this the backup client must run on the DC and the Exchange server, respectively. Since we only have one server backup license, our current process is to back up all of the other machines and servers to a central location, then allow the backup client to back up this data. However, since the client must run on the DC to back up Active Directory and the Exchange server to back up Exchange, this obviously presents us with a problem.

We also use Windows Server Backup to back up fill images of all of our servers to external hard drives that get swapped out once per week, but we'd like the added security of having our AD and Exchange data current (and not potentially 6 days old).

The solution we're tossing around right now is simply to convert the Exchange 2010 server into another domain controller, which would allow us to back everything up to that machine and grab our files, AD, and Exchange data all at once. What sort of problems might this cause?

  • 1
    @Massimo: Thanks for rewording the title; that is clearer. – Adam Robinson Jul 13 '11 at 16:25

Promoting an existing Exchange server is not supported, it is stated quite clearly by MS here:

For security and performance reasons, we recommend that you install Exchange 2010 only on member servers and not on Active Directory directory servers. However, you can't run DCPromo on a computer running Exchange 2010. After Exchange 2010 is installed, changing its role from a member server to a directory server, or vice versa, isn't supported.

The only way you could do it would be to either remove exchange, install AD then put it back, or setup a new server, make it a DC, then install Exchange in the same organisation and decommission the old one later.

If you really cannot get another backup licence then I would go with that Dave suggested and use Windows backup (or NT backup) to get a system state backup, move this to a share and have the backup software back that up.

| improve this answer | |
  • Thanks; the link to MS saying that it's not supported as all (versus being "not recommended") should do the trick. – Adam Robinson Jul 13 '11 at 17:07

Virtualize. You said it's not in the cards to buy more hardware; what about just another backup license?

Aside from this setup being extremely unpleasant to support, I'm fairly certain that it won't fly to install the DC role after exchange is already running; the destruction of the local user store doesn't seem like it'd sit well with a running exchange install.

| improve this answer | |
  • Another backup license is possible, but I'm not keen on selling the idea if there's a "free" option, unpalatable as it may be (for instance, we're running exchange for this small of a number of users because our Microsoft partner license gives us a license to Exchange, whereas we would have to pay for a hosted solution). If I had a solid reason other than "you really shouldn't", I might be able to make the case. The idea about the local user store is interesting; I hadn't thought of that, and it's a good point. – Adam Robinson Jul 13 '11 at 16:18

Use a scheduled task to backup your active directory to a file using Windows backup (aka ntbackup on 2003) and then use a script to copy it to a share on the Exchange Server. Then, you can pick up the file with your backup software as you are backing up filesystem on the Exchange Server.

Don't install them on the same box, you'll regret it.

| improve this answer | |
  • Thanks; yeah, I'm fairly sure I will. I'm trying to come up with actual reasons that I can list that makes this not an option (like @Shane's comment about the fact that the local user store will be destroyed). As for backing up AD to a file, the problem is bandwidth; if it's just a file, then the backup client will just see a ~10GB file that's changed and will back up the entire file every day (or try to, anyway), unless I'm missing the fact that the client can back up block-level changes to a file, rather than just detecting that the file has changed. – Adam Robinson Jul 13 '11 at 16:24
  • 2
    Some reasons for your list: theessentialexchange.com/blogs/michael/archive/2008/03/29/… – Dave P Jul 13 '11 at 16:38

Installing Exchange 2010 on a domain controller is supported but definitely not recommended.

Promoting an already-existing Exchange server... well, I Googled and wasn't able to find anything about it, probably because it's such a crazy operation to do that nobody ever tried it (the same for demoting an existing DC-Exchange); I can think of at least a dozen ways this could break Exchange.

The security model of a domain controller is something completely different from that of a standard member server. The DC promotion process destroys a server's local user database; it makes heavily changes to ACLs for the filesystem, the Registry and DCOM; it applies a different (and much more strict) security policy. The bottom line is, Exchange could work again after the promotion, or it could show some minor issues which can be fixed... or it could just completely break. This is not supported and (probably) has not even been tested by anyone. I'd suggest you set up a test lab and see what happens... but I'd still not recommend doing such a thing on a production server, even if testing goes well.

| improve this answer | |
  • If you would, could you please enumerate some of these ways it could break Exchange or AD? I would very strongly prefer not to do this, but I'm going to have to justify why not other than a generic "it's not recommended". – Adam Robinson Jul 13 '11 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.