0

Running Win Server 2008 R2 with Hyper-V role. Is it okay to have domain controllers inside a virtual machine with other virtual machines that are part of that domain? The host computer will not be part of a domain controller. Hyper-V is configured to delay the boot up of other virtual machines to make sure the domain controller starts first.

Improve this question

3 Answers 3

Reset to default
5

This is fine, but like any other environment, best practices are to have more than one Domain Controller for any given domain. Since you're virtualizing, you'll want each DC to run on more than one piece of hardware.

In VMWare you can make DRS rules so that the two DCs don't get vMotioned to the same physical box, I'm sure there a similar thing for Hyper-V. Or, if you're just using it stand-alone, pop up another DC somewhere outside of the virtual environment.

Improve this answer
17
  • 4
    Curses... trying to answer questions on Serverfault when I know you're also online is like playing Minesweeper...
    – Ryan Ries
    Nov 13, 2012 at 14:13
  • I have three physical servers. Two physical servers will run Hyper-V with one domain controller on each inside a VM. The third is just our backup server.It's a small organization, so consolidating would be better. And since it's not recommended to make a DC run more roles, this seems to fit our need best.
    – NoMoreDell4Me
    Nov 13, 2012 at 14:15
  • 1
    In Hyper-V you need to set up your Hyper-V hosts in a failover cluster and then you need to select the Possible Owners for the clustered VM to define an "affinity" rule analogous to a VMware DRS affininty rule.
    – joeqwerty
    Nov 13, 2012 at 14:18
  • 1
    @NoMoreDell4Me You should do two backups, one of the whole image and one of the system state. The full image backup will let you restore from bare metal in a disaster. The system state backup will let you do an authoritative restore of AD if you accidentally do something like delete an OU. AD Domain Services is a relatively low-load role. As long as both DCs are Global Catalogs, you shouldn't have too big of an issue if one of them is down for a short time.
    – MDMarra
    Nov 13, 2012 at 14:23
  • 1
    Wait, what do you mean by "save that file"? You shouldn't make a new domain controller from the backup of a previous one. That's a recipe for disaster. You should only restore a dead DC from its own backup. Bare metal backups aren't the right way to "clone" a new domain controller. Should you never ever promote any Domain Controller that's from a cloned image and hasn't been sysprepped. Also, you're really asking things that are out of the scope of this question. If you have a question about how to handle backups, ask a new question.
    – MDMarra
    Nov 13, 2012 at 14:39
2

I've been doing it at my company for several years, and it's worked quite well for us.

Microsoft has some articles published (here and here) that you should probably read.

The biggest suggestion I have is that you shouldn't do a P2V conversion of existing domain controllers. Instead, create a fresh VM with windows installed, and do a DCPromo on it, then decommission the old DC, remembering to move the FSMO rules.

Improve this answer
4
  • Our physical machine that we have now needs to be replaced. So I currently have two physical servers with Hyper-v installed. I created the VM on each and will do a dcpromo. Then demote the old server. This way the DC are on two physical servers inside their own VM.
    – NoMoreDell4Me
    Nov 13, 2012 at 14:18
  • If you need HA for your VM's in case of a host failure then you should install Failover Clustering on your Hyper-V hosts (you'll need shared storage and a quorum disk or file share). In the case of your DC's you can configure them to have "affinity" for a particular Hyper-V host or you can configure them to failover to and failback from the other Hyper-V host if one of the hosts fail.
    – joeqwerty
    Nov 13, 2012 at 15:05
  • Server 2008 R2 standard doesn't seem to support failover clustering.
    – NoMoreDell4Me
    Nov 13, 2012 at 15:30
  • It doesn't. Sorry, I didn't catch which edition you were running.
    – joeqwerty
    Nov 13, 2012 at 15:44
1

Yes you can have domain controllers as virtual machines on a Hyper-V host. I would not recommend that they be your only domain controllers though. Physical machines are preferable for domain controllers in my opinion. Also, don't snapshot and restore virtual machine Domain Controllers like you would with other VMs. That can cause USN rollbacks and lingering objects.

So yes, you can do that. Definitely if it's a lab or development environment. But for a serious production environment I would suggest some physical DCs.

Improve this answer
2
  • Why do you say that "Physical machines are preferable for domain controllers"? -- A properly configured VMWare cluster with high availability will give you substantially more reliable DCs than you can get with physical hardware. The only caveats I'm aware of are the snapshot/restore issue you've mentioned, and potentially time issues if your hypervisor has issues with keeping guest clocks sane.
    – voretaq7
    Nov 13, 2012 at 17:44
  • That's why I said "in my opinion." I like my physical DCs. I understand that a virtualized domain controller is a perfectly acceptable and supported thing to do, but I mean within the context of this question, the OP only appears to have a single host, not a cluster. You can also mix and match, like having one physical DC, and a virtualized DC for redundancy.
    – Ryan Ries
    Nov 13, 2012 at 21:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .