1

We have 4 sites, two in the same city, two elsewhere. Each site will be fully autonomous but there will be occasional VPN links to allow AD replication as our users float around the sites. Everything should be replicated.

I would like to use a topology using the site's city as the child domain. So for instance we would have:

  • dc-site1.sydney.mycompany.lan
  • dc-site2.sydney.mycompany.lan
  • dc-site3.melbourne.mycompany.lan
  • dc-site4.perth.mycompany.lan

My question really is with regards to the parent domain in a new forest. In a new set-up I can't create a child domain. So my DC is dc-site1.mycompany.lan. This doesn't really make sense in the above topology as it implies the DC is orphaned. We don't have a HQ as such.

I could, in one site, have two DCs: the parent and the child, but would this be confusing? Any machine should always join a child domain so the parent has no responsibility, other than perhaps replication.

Can anyone advise how this would work? Can the parent and child hapily co-exist on the same subnet?

Improve this question
1
  • 1
    If I understand you correctly, are you asking if it's a good idea to have an empty forest root domain (mycompany.lan) with a DC in each location, and then a child domain for each location? – Chris McKeown Sep 12 '12 at 7:19
3

Well, my first bit of advice would be don't do that, because it won't work, at least not like you seem to think it should.

I bet you want one forest, with one domain and 4 sites in it. Set up 4 sites, not 3 child domains. (shudder) You use Active Directory Sites and Services to set up, configure and manage your sites.

(And, just as a PS, you can have as many Domain Controllers per site or domain as you can spin up. The recommended maximum is 1200 per domain, with a theoretical limit of just over 2 billion.)

Improve this answer
3
  • Yes this is correct. After writing the post I wasn't comfortable with it. The location child domain is irrelevant. So what there's 2 sites in the same city? There's no value in this. A single domain is all that is reqd. With AD sites & links setup to manage replication. What I actually wanted is to use DNS zones maybe? So I can avoid duplication of machine names. For instance, we have a small VDI setup with a set of cloned vm's named V1 to V10. The same setup is in another site. – Neil Dobson Sep 12 '12 at 12:29
  • @NeilDobson 1) If you have separate physical sites in the same city, you might want different AD sites for each. (We have three physical locations in our home city with domain controllers, so three sites.) 2) DNS zones are an option if all you're worried about replicating is DNS, but AD Sites and Services is used to manage replication of all AD data between domain controllers at different sites, so it has value beyond just DNS replication. 3) You don't "need" separate sites at all, but all that traffic will come back to the one site's domain controller(s), which may cause issues as a result. – HopelessN00b Sep 12 '12 at 15:31
  • ...continued... Issues such as network bandwidth utilization and latency. Having a more local source for all the AD-related lookups and AAA checks (Authentication, Authorization, and Accounting) decreases latency and may noticeably improve client experience, and like that there. But, as I said, extra sites are not absolutely needed, so other than less than optimal performance, there shouldn't be a problem, per se, with just having one AD site. – HopelessN00b Sep 12 '12 at 15:36
2

Just to add to HopelessN00b's answer.

It used to be considered a good idea to have an empty forest root domain in some situations (possibly a bit of a hangover from the NT4 account domain/resource domain model) but these days you don't see anyone recommending it.

Having an empty forest root can be handy if you want to segregate your DNS namespace for some reason (although you don't really need an empty forest root domain - you can have disjoint DNS namespaces but one of the domains will have to be the forest root domain)

EDIT: Forgot to add - In conclusion, just read HopelessN00b's answer :-)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.