We've inherited a customer who after auditing their site turns out they used to have a site-to-site VPN and another DC at the endpoint (which was the only GC in the forest). THe previous IT company demoted this, cleaned up AD, but never made their now main DC a GC.

We want to replace their current DC (2003) with a 2008R2 box, is it best to make the current DC a GC first then dcpromo the new DC, or does it not matter? Bare in mind the new DC will be made a GC.


I would recommend (and so does Microsoft) that you make all domain controllers global catalogs unless you have a very good reason not to.

You need network access to the RID Master FSMO role holder for the domain before you can promote a writable domain controller. Otherwise, only an RODC could be created, which I'm guessing is not what you want.

But to answer your question more directly, a domain controller does not need a global catalog to be promoted into an existing domain.

Edit: I have verified via lab testing that I was able to promote a new domain controller into an existing domain with the bare minimum of a non-GC domain controller online that was hosting the RID FSMO. The other 4 FSMOs were down and no global catalog was up.

Here's some more info from the fantastic AskDS blog about other reasons you will want a global catalog online, even in a single-domain forest:


If I have only one domain in my forest, do I need a Global Catalog? Plenty of documents imply this is the case.


All those documents saying "multi-domain only" are mistaken. You need GCs - even in a single-domain forest - for the following:

• Perversely, if you have enabled IgnoreGCFailures (http://support.microsoft.com/kb/241789); turning it on removes universal groups from the user security token if there is no GC, meaning they will logon but not be able to access resources they accessed fine previously).

• If your users logon with UPNs and try to change their password (they can still logon in a single domain forest with UPN or NetBiosDomain\SamAccountName style logons).

• Even if you use Universal Group Membership Caching to avoid the need for a GC in a site, that DC needs a GC to update the cache.

• MS Exchange is deployed (All versions of Exchange services won't even start without a GC).

• Using the built-in Find in the shell to search AD for published shares, published DFS links, published printers, or any object picker dialog that provides option "entire directory" will fail.

• DPM agent installation will fail.

• AD Web Services (aka AD Management Gateway) will fail.

• CRM searches will fail.

• Probably other third parties of which I'm not aware.

  • 1
    Thanks, yes all DCs should be GCs, and the new DC we will put in we replace the current one (we will also be building a VM DC as backup). The question was really, does DCPromo operations need a GC – PnP Jul 27 '13 at 18:14

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.