If I have Windows PCs that are joined to a domain and the domain controller goes offline, what kind of behavior can I expect on the clients (assuming there is no second DC?)

  • Will users be able log on? Or perhaps a better question, how does login functionality change, if at all?

  • Obviously file shares on the DC won't work, but what about shares between clients, or between them and a member server?

  • Once the DC has recovered, do the clients need to restart, log off/log in? Are there any long term consequences from being disconnected from the DC?

Ultimately I'm interested in what complaints I should expect to receive from users if the DC is offline. Feel free to mention any other important information that I haven't covered.

  • I'm not sure if logonserver will change automatically. If not you will have to set it manually by issuing the command strong textset logonserver=\\workingDCstrong text Im not sure though what is the behaviour, if a computer's logonserver automatically switches to the working one. – janus Feb 16 '17 at 2:32

Quite a few things will happen with no DC available:

  • If the domain controller is the only DNS server, the first complaint you will get is that the internet is broken, because the clients have no DNS.

  • Since DC's usually also run DHCP, computers won't be able to connect to the network at all. Computers that are already connected will keep working for awhile.

  • Files shares they are already connected to will work fine for awhile (a few hours likely), until their session expires. When the file server goes to validate their credentials, it won't be able to talk to the DC, and won't let anyone connect anymore.

  • Anything else that relies on active directory authentication (like IIS sites, or VPN servers, etc) won't let people login. Depending on the setup, it might immediately kick people off, or might keep existing sessions and just not allow new ones.

  • For the computers themselves, people who have used the computer recently will still be able to login. People who haven't used the machine before, or used it a long time ago won't have any cached passwords, so they won't be able to login until the connection to the DC is restored.

  • There are long term consequences to being disconnected from the DC - eventually nobody will be able to login with a domain account, because the cached passwords will have all expired. If you are unable to reconnect to the DC, and don't have any local accounts enabled, you can end up in a situation where you need to use utilities like NTPasswd to enable the local administrator account.

The best practice for domain controllers is to have at least two if them. So much in a windows network relies on active directory that you need the redundancy. For a smaller organization, it can share roles with file servers, though avoid having a domain controller share a server with things like sharepoint and exchange (it makes restoring and upgrading them very tricky to do properly)

With two domain controllers, if one dies, you can just reinstall windows server, set it up as a new domain controller in an existing domain, and off you go. No downtime at all. With a single domain controller restoring can be tricky. And while you're restoring, you have people upset that they can't do anything.

  • If you run DHCP on the domain controller, you may have some downtime... unless you set up DHCP for HA somehow... – ETL Feb 14 '19 at 22:04
  • @ETL The DHCP service in Windows server can very easily be setup for high availability. – Grant Feb 15 '19 at 23:04

Depends on the duration. Once you remove a service from the network things become unreliable but may not break. If you just want to reboot a DC then authentication/authorization should not really be interrupted. People will log in with cached credentials, boxes that are already communicating will keep doing so with their existing Kerberos tickets etc.

So people can login to their PCs with cached accounts. They can't change passwords etc.

For a short (hours but not days) while they should all be able to access file shares not on the DC as well but eventually that will stop working.

Things should recover automatically once the DC is back up.

There is a big caveat here though. If you are using your DC for DNS as soon as it goes offline most stuff will stop working because clients won't be able to find their servers. Even things not dependent on AD rely on name resolution.

The best thing to do is build a 2nd DC with backup DNS on it so clients can fail over. The AD part will happen automatically, the DNS part you will need to configure on the clients as a 2ndary DNS server either on the client or via DHCP etc.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy