I am currently working in an environment where there are 2 DC's running and another DC that is a backup but is currently running as well so that if the other 2 fail, the backup has everything needed to be ran successfully.

The problem that I am currently encountering (really isn't too much of a problem, just the client would like it to run a certain way)is that when some users login, they are getting their group policies from the Disaster Recovery DC. The reason this is happening is because they are all on the same network with same subnet mask etc.

My question is, is there a way so that when a user logs in, the computer will be more inclined to go to the 2 main DC's rather than the Disaster Recovery DC?

Would it be with the metrics of the routing, or is there a certain part of the server that I can turn on and make it the more "Dominant" server.

The servers are Windows 2k8 servers running as VM's. Any more info needed I can get.


  • 1
    I think smithian has given a good answer, but I'm going to have to ask where this notion that another DC in the domain is a "Disaster Recovery" domain controller. It will obviosly help if the other DC fails (and this isn't "disaster recoverery", it's multimaster domain controllers behaving as designed), but if someone deletes something important from AD then... oops it's replicated to the "disaster recovery DC". Have you explained to your client that Microsoft doesn't describe additional DCs in a domain as "disaster recovery DCs" for a very good reason? – Rob Moir Oct 26 '12 at 16:40
  • 1
    Can you please define exactly what you mean by "backup domain controller"? – MDMarra Oct 26 '12 at 17:31

Your client is doing it wrong. There's no such thing as a "disaster recovery" DC. for all intents and purposes all DC's are equal. You're allowing your client's lack of understanding to drive this scenario when you should be educating them instead. Without getting into the vagaries of FSMO role holders, global catalogs, AD authentication and authorization, Site coverage, replication, etc., etc. and all of the other minute details of AD function and operation I'll simply say that you don't need a "disaster recovery" DC; that the term "disaster recovery DC" is anathema to people who do understand the workings of AD; and that you should stop immediately and educate yourself on the finer points of Active Directory before moving forward with making any modifications.


If you are truly using the second DC as a 'disaster recovery' DC, then you should move it to a second site in AD Sites and Services. This will cause the clients to authenticate to the 'closest' DC. I typically setup two DC's for disaster recovery, but I allow the clients to use them both.

If you are pulling different GPO's from the DR server, then something is very wrong with your setup. GPO's should be synced across all servers within minutes of being changed.


You can change the weights of the entries in _msdcs.yourdomain.com to make the Disaster Recovery DC less preferred. By default they will have the same weight and clients will round-robin between them.

I don't recommend manually futzing with your domain controller DNS entries however. It would be cleaner to move the DR DC into a separate site in ADSS.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.