Not sure what I am doing wrong here. I have a moderately midrange server (16 cores, 2Ghz, 32GB ECC REG RAM, 6TB storage, nothing too extreme) where I am running Hyper-V (Server 2012 R2 Enterprise) in order to provision virtual machines. So why an AD separate from DNS? I want redundancy. I want to be able to move VMs and back them up individually and not have too many services on any one VM.

I have already provisioned a VM with DNS, and have set it up right -- essentially, I have:

  1. Set up Static IP’s for everyone involved.
  2. Installed the DNS service on the DNS VM.
  3. Created a forward lookup zone and a reverse lookup zone (primary zone) xyz.ca
  4. Configured the zones to use nonsecure and secure dynamic updates (i will change this to secure later after the domain controller is online).
  5. Created a A record for the DC in the forward lookup zone (and a reverse ptr)
  6. Changed DC’s DNS server (network settings) to the new DNS server.
  7. Checked that I can ping the dns server from the new DC by hostname.

When I went ahead and did a DCpromo on the DC, and un-cheked the “install DNS” option, everything seemed to go well (no error messages), but I saw no changes on the DNS server whatsoever (no additional settings). Plus, the DNS server seems to be unable to join the domain, as it claims that the domain is not discoverable.

As a final note, I do run Symantec Endpoint Protection, which includes a firewall and most settings set as default. I have not yet tried turning this off, but my experience has been that if a service would open up a port on a Windows firewall, it would do the same through Symantec. There is pretty tight integration these days with corporate-class AV and Windows.

I have a template vhdx fully set up (just short of any special roles and features) that I can use to replace the current AD VM with, so doing this all over again is not too much skin off of my nose.


I think there is some inconsistencies in your design, since you cannot convert a DNS primary zone into a Active Directory integrated zone if that zone is not stored in a Domain Controller. On the other side there is no way to allow only secure updates on a zone if that zone is not an integrated zone in Active Directory. I think that having redundancy is a good idea, particularly for AD, but the best way to achieve this is to deploy two DC with the DNS server role enabled.

Here are some links that I think you may find usefull:

  • So what you’re saying is that I should be using a PDC and an SDC and simply include DNS services with the DC? That would allow me to run the SDC on a secondary machine that I will (eventually) be flagging as a failover machine if there is a physical fault with the primary. Of course, it is only a repurposed desktop machine, but it should be able to handle at least two concurrent VM’s (the SDC and the SQL). – René Kåbis Oct 23 '13 at 17:39
  • 1
    1. Stop calling them PDC and SDC. 2. Both should be running all of the time. 3. You don't "fail over" from one to the other, they both serve your domain clients. – joeqwerty Oct 23 '13 at 17:44
  • Well, I have to name them something, so it might as well be PDC and BDC. Lets me know which is which and (in the end) what machine they are currently on. – René Kåbis Oct 23 '13 at 18:02
  • And besides, I was talking about physical machines in terms of failover. Yes, I know that both PDC and BDC will be equal. However, if the main server fails, I want a secondary box that (at least temporarily) can carry the network services entirely by itself. That’s why I have gone with virtual machines -- so I can set up on one, and deploy over to the other. That if the machine’s hardware fails entirely (other than the storage RAID array) I can copy-and-paste everything over to a third server. – René Kåbis Oct 23 '13 at 18:31
  • Hi @RenéKåbis, terms like PDC and SDC, as joeqwerty states, are not the best to refert to a DC. With Active Directory, Microsoft change its domain tecnologies from the Windows NT Domain services to an LDAP based Directory Service, which in turns means that the PDC and SDC roles as it existed on NT4 no longer exists. That's only part of the history since with AD new roles were put into the scene. So talking about a PDC (better call it PDC Emulator) its correct, but talking about SDC is a wrong term in AD terminology. – SantiFdezMunoz Oct 24 '13 at 7:53

You're breaking up your VM roles too much. If you intend to run AD-integrated DNS then your AD VM should also host your DNS services. If you want redundancy, deploy two AD/DNS combination VM's.

  • 3
    Agreed. splitting the DC and DNS roles onto separate computers for "redundancy" is doing it the wrong way. Install the DC and DNS roles on the same computer, use AD integrated DNS zones, and have at least two DC's configured as such. – joeqwerty Oct 23 '13 at 17:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.