I have a forest with two DCs, one of which was added as a peer to the original DC.

One DC is running Windows Server 2008 and the other is running Windows Server 2008 R2. I can see on both servers that workstations are being assigned IP addresses from both DHCP scopes and that all records are registered in DNS.

To do a test on the domain, I took down the original DC that was in place to check that all users would still authenticate to the new peer DC, but it does not appear that they are doing so and that the machines are logging onto their local accounts.

  • You probably want the second server to be a global catalog, unless you want Exchange (and every other software relying on it) to fail each time your first DC goes down. You'll find the option under AD Sites & Services, under NTDS settings for the second DC.
  • Check that the DHCP scopes on both servers have both domain controllers in the DNS option 006 (DNS Servers). A good practice is to have DC1, DC2 listed on DC1, and DC2, DC1 listed on DC2
  • (After doing the previous step), make sure that the clients can resolve domain lookups. Run ipconfig /all to verify that they have both domain controllers listed as DNS servers, and then do a nslookup domain.name. The result should be a round-robin reply of both the domain controller IP adresses.
  • Check that DC2 has DC1 as primary DNS server on its LAN interface, and that DC1 has DC2 as primary DNS server. Put as secondary DNS server on both DNS servers
  • Run dcdiag on both domain controllers to spot any issues
  • Check the event logs on both domain controllers to spot any issues that dcdiag didn't pick up
  • Don't disconnect the other domain controller for an extended period of time. You should only do this on purpose in short periods of time
  • DC2 is a global catalog and both DCs have their 006 options set in this fashion as well. I will nslookup and double check that I receive a round-robin reply and will report back any other information. – Pretzel Jul 26 '13 at 13:51
  • @Pretzel any updates? – pauska Jul 30 '13 at 14:25
  • Sorry it's taken a number of months to get back to you, actually forgot I had asked this. Once the DHCP on the peer domain started handling users, they began to authenticate to the domain. – Pretzel Dec 30 '13 at 14:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.