In one forest, I have a Windows 2003 AD Integrated DNS as my primary DC. I then configured an additional DC on the same forest with it being AD Integrated DNS as well. My thinking is that on my client machines (XP/7), on the DNS settings in tcp/ip, the Primary DNS configured there is pointing to the Primary DC's ip address and the Secondary DNS is pointing to the Secondary DC's ip address. Since both DC's are also AD and DNS, does this mean that in the event the Primary DC fails, the client machines should still be able to login to the domain since I have a Secondary DC with AD Integrated DNS in which it will also authenticate all users on the domain, right? Highly appreciate everyone's advice.


Yes, that's what it means. Assuming your second DC is actually set up properly, if your clients can't reach the first DC, they will try the second one... and assuming the second one is reachable and properly configured, they'll be able to log in. In that vein, make sure the second DC is setup as a Global Catalog.

P.S.: Active Directory (post NT 4) is set up as a multiple-master configuration, so there's no such thing as primary or secondary Domain Controllers anymore. The proper term is Primary Domain Controller Emulator (PDC Emulator). See this Microsoft support article for more details.

  • Yes, the second DC is also configured as a Global Catalog server as well. Had no errors after running DCPROMO letting Windows configure AD and DNS automatically. Highly appreciate your post :) – GeePee Jan 17 '14 at 12:13
  • @GeePee Just FYI, it would probably be beneficial to you if you waited a day or two to mark an answer as complete. It gives more incentive for someone else to come along and provide additional and/or more complete answers, and also leaves the question in the unanswered category so that more people view it. – HopelessN00b Jan 17 '14 at 12:24
  • Noted. Appreciate your advice. Will do that on my next post :) – GeePee Jan 17 '14 at 12:27
  • There may not be a Primary Domain Controller, but you still can only have a single master machine for a select few operations per forest or per domain (and be wary that you must migrate the responsibility if you are going to demote or remove a machine from the network who is filling one of the operation master rolls) – Scott Chamberlain Jan 17 '14 at 20:58
  • @ScottChamberlain Yup. Check the 2md/final link in my post. Spells out the FSMO roles. – HopelessN00b Jan 17 '14 at 21:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.