I've inherited a Windows 2003 active directory single domain spread across multiple site locations. I'm checking configuration because previous admin left without leaving any information about his design choices. Actually we have:

HEADQUARTER: (circa 300 users) SRVHEAD1 - holding all FSMO roles (virtual host on vmware infrastructure) SRVHEAD2 - Global Catalog (physical host in a separate room)

BRANCH1: (circa 30 users) SRVBR1 - GC

BRANCH2: (circa 20 users) SRVBR2 - GC

BRANCH3: (circa 10 users) SRVBR3 - no GC configured.

Each branch is connected to headquarter via a MPLS circuit. Connectivity is not always 100% reliable. Headquarter and branch sites have a relative site in Active Directory Sites and Services.

What is not clear to me is why only one GC on headquarter... what if I enable GC on BRANCH3 and on SRVHEAD2 ? There may be problems? And with only one GC on headquarters, in case of troubles with the GC holdin server can I rebuild it replicating from another server? Thank you !


Legacy guidance was to have a GC only where you need them. This is outdated now and the modern recommendation is that all DCs be GCs unless you have an extremely compelling reason to reduce replication traffic.


I guess that technically within a single domain single forest setup you don't actually need GCs at all.

They will prove useful if your links are unreliable between sites though.

In terms of rebuilding the info is read from AD itself so it doesn't really need rebuilding. To assign a new one you simply use the Sites and Services tool.

AS for "only one GC at HQ" I am guessing that as not all your DCs are GCs then your previous admin is trying to avoid the issue of having the Infrastrucutre Master FSMO role hosted on a GC. Can't remember the exact ins and outs of the issue but it is normally better to either host it on a non GC or have all DCs as GCs.

In terms of "problems" enabling GC on other servers I cannot forsee any but I suppose you should maybe question why you are using them or what benefit you think you will gain from them. Their main purpose is to hold Universal group membership so if you don't have many Universal groups then this may all be fairly irrelevant.

  • 1
    Many applications do lookups against the GC, even in a single domain environment. – MDMarra Feb 26 '14 at 12:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.