Need for another Domain Controller

Question

I have two domain controllers (Windows 2003) in one site where most of the department I support resides. There is another building (at another site) where my department resides as well, but they have no DC.

This probably a classic question of whether to install an additional DC when a company is spread out over multiple sites.

We've been experiencing various issues like login scripts not mapping drives and users failing to login several times before being let in (even though they're typing the right password).

I'm getting different errors on the clients. Some of them are :

Netlogon, 5719, This computer was not able to set up a secure session with a domain controller in domain domain.com due to the following: There are currently no logon servers available to service the logon request. This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator.

GroupPolicy, 1055, The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following: a) Name Resolution failure on the current domain controller. b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).

On the servers I keep getting these errors:

Netlogon, 5722, The session setup from the computer SOMEPCNAME failed to authenticate. The name(s) of the account(s) referenced in the security database is SOMEPCNAME$. The following error occurred: Access is denied.

*(this above error keeps repeating for the same computer. Probably just need to re-add this to domain. ) *

NTDS Replication, 1864, This is the replication status for the following directory partition on the local domain controller. Directory partition: CN=Schema,CN=Configuration,DC=domain,DC=com

This last one looks like it has to do with a DC that wasn't completely removed. When I ran dcdiag, it showed that we are trying to replicate with a server that doesn't exist anymore. I don't think this would cause us to have all these logon problems though.

I'm wondering if we should install another DC or try something else. Our clients run mostly windows 7, but there some XP and Vista clients as well.

The bandwidth looks to be 37.4 Mbs between PCs on the different sites (just verified with this utility iperf).

Any help is appreciated.

Answer 1

@gWaldo has a good idea in terms of increasing reliability and updating your outdated DC, but it's a "guess" as to if it'll fix the issue. @Chris-S is correct in comment that bandwidth (at first glance) doesn't sound like it's the issue either.

First you should ensure that WAN connection is reliable, has no packet loss, and has ample available bandwidth throughout the day.

Also a DC not being available will not prevent a Windows client login (assuming default GPO's) because cache credentials on a domain let you in. It would help if you posted the actual errors the users are getting.

For mapped drives, if they are done by login script then you have little to no ability to see any logs about that info, but I would move that functionally to Group Policy Preferences which will let you map drives, make them persistent, and also log to the client event logs on any issues. Your mapping issues could be either they can't get the script, or they can't access the drive... but hard to tell without logging.

Again, keeping DC's current and having one at remote site is "better" but is just throwing darts at the wall of this specific issue. I've had 70-100 remote sites on much lower WAN speeds with no remote DC's act just fine as long as connection was reliable and had available bandwidth.

Answer 2

There is a lot of room in your question for other problems to be causing problems, but on the surface (if you are fairly certain that everything else is working as expected) you sound like you may be a good case for a Read-Only Domain Controller (RODC).

This would necessitate upgrading to Server 2008 for your DCs (which is a good idea, anyway; 2003 is nearing end-of-life), and a little care in setting up the RODC, but it could solve your problems well.

Yes, you could just set up another 2003 DC in the remote office, but it sounds like there isn't an IT presence there, so a RODC may be 'safer'. RODCs are good where you may not have an IT staff, especially if you don't have a safe and secure area for the server (no server room / lockable racks, shady neighborhood, etc)

Also keep in mind that the mapping of drives over the network is going to eat up bandwidth, and by itself could be a major cause of your problems. It may be worthwhile to investigate a local implementation of a storage solution (such as DFS or CIFS servers).

If you haven't already, separating your organization based on location (whether by Sites or just OUs) could also help you with managing traffic and user experience.

Answer 3

I would definitely put another dc at the remote site to provide some redundancy should the connection between the sites fail.