-1

I have comprehension question. Let us assume I have an ESXi environment about 20 running VMs. One of the 20VMs is the domain controller (DC01) as a single domain controller (no other sides are configured). The domain controller (DC01) has installed roles like AD and DNS-Server.

And the other 19VMs have a static DNS configuration, thats meaning their DNS configuration is static with the IP of the domain controller (DC01).

Now what would be happen, if I shutdown the domain controller? Which services would be down? If I should shutdown this server for an hour, would anybody realize that the domain controller was down? Thank you in advanced!

Domain controller = Windows Server 2008r2 Other Server = Windows Server 2008r2

Improve this question
6
  • No internet connectivity would be the main thing, logins would be slow if they are domain members.
    – DanBig
    Mar 6, 2014 at 19:15
  • 2
    @DanBig technically, they would have connectivity but would, likely, not be able to resolve anything depending on if they have a secondary DNS server configured on the clients, TTL time out values of sites already in the client cache, etc. Logins may or may not be impacted depending on cached credentials and if they have GPO settings forcing a check in to the DC before allowing login, startup scripts, login scripts, drive mappings, etc..
    – Rex
    Mar 6, 2014 at 19:16
  • 1
    This is really going to be too broad of a question to answer here without having more information on your environment/applications/configurations/etc. And if you provided that info, the question would be so narrow in scope to just YOUR environment, that the question would be useless as a reference for anyone else.
    – Rex
    Mar 6, 2014 at 19:18
  • @Rex No, im not agree with you. Its interesting information to know that they havent any internet connectivity. Now I that. Whats about maybe UNC connections. Would that function?
    – MaxMix
    Mar 6, 2014 at 19:21
  • @MaxMix Would it function? Maybe. Depending on if they are the same network and can do broadcasts to resolve the name (provided you have that configured). Of course, UNC connections by IP address would likely connect - but then you have questions of authentication depending on how the shares and NTFS permissions are set. Again - too many other questions to really dig into this. This is not the right venue for this type of conversation.
    – Rex
    Mar 6, 2014 at 19:22

3 Answers 3

Reset to default
8

In general, you'd lose two things.

  1. Directory Services
    • What all this encompasses is environment specific, but at the very least, we're talking about AAA services.
      • Computers which stored cached credentials would still let some users log on (those who are in the cache), but beyond that, domain accounts would not function.

  2. DNS
    • Because Windows uses the domain controllers to provide domain name resolution, you'd lose the ability to do DNS lookups, both for the local domain, and any external resources, since your machines are set to use the domain controller for DNS.
      • Cached DNS entries would still work, so you'd have some functionality there, and would be able to access resources by IP, but any new DNS lookups would fail (including, say, redirects on the web).

Because AAA and name-services are so important to having a functional network (you can't very well expect users to access everything by IP and use local accounts), this is why Microsoft recommendations are to always have at least two domain controllers, and best practices state that at least one should be a physical machine (to avoid single point of failure - if all your DCs are virtualized, and your hypervisor goes down, the extra domain controller(s) go down too).

Improve this answer
7

You would lose:

  1. Logins. Cached credentials would work, if the user had logged on before, but new domain logins would fail.
  2. Network shares. Your Kerberos ticket duration and enforcement are set by domain policy, but accessing network shares would begin to fail across your network.
  3. DNS. You and/or your service desk would begin to receive "no internet" calls. They'd still have connectivity, but they won't be able to resolve things, inside or out. This could also have the effect of people calling you and/or your service desk to tell you your various servers are down.
  4. DHCP. If you're using Windows DHCP, If DHCP is on this box, no one will be able to get a new IP address. (Ignore this point if you're using something else for DHCP.)
  5. Your VPN, if any, if it uses AD credentials.
  6. Any other service that uses AD credentials (Network Access Control, websites with integrated security, etc.).

TL;DR: Yes, people would notice.

Outside the scope of your question but worth mentioning: As HopelessN00b points out, best practice is to have at least two domain controllers. It's also a good idea to have one be physical hardware, both in case the VMware host goes down and because the VMware host may rely on AD for DNS, which produces a dependency issue.

Improve this answer
4
  • 1
    1.Local account logins would work just fine. 2.Shares may or may not work depending on if they could resolve the name by broadcasts and/or used IP address to connect to the shares and depending on how the permissions are set. 3.DNS will likely fail unless they have a secondary DNS server up that is either outside their org or on a non-DC system. 4.DHCP has nothing directly related to the DC. OP never mentioned if this role is on the DC as well or not. 5.VPN fails only if it uses AD creds. 6.Other services may vary depending on how configured and if they cache any creds on their end as well.
    – Rex
    Mar 6, 2014 at 20:03
  • I'll give you the DHCP, although the OP only has the one AD controller, so he might be running DHCP on the same box. On the other hand, I don't know a lot of AD shops that use local accounts exclusively, or even heavily.
    – Katherine Villyard
    Mar 6, 2014 at 20:06
  • I generally don't run DHCP on a DC but a standalone member server. Lots of places run it on the DC - but it doesn't have to be. And I agree, most places wouldn't be using a lot of local accounts but lots of places do setup local groups authentication on resources and the user would still have their token for a good amount of time. I'm not really disagreeing with you - I think people will notice.. but we don't know enough about how the OP is setup to judge the full impact.
    – Rex
    Mar 6, 2014 at 20:07
  • @Rex I was making assumptions about how the OP had set up his environment based on his question, which I shouldn't do. It's right of you to point that out.
    – Katherine Villyard
    Mar 9, 2014 at 15:41
3

Anything that depended on AD and DNS would no longer work. Cached credentials would work for interactive logins, not sure they would be any good for network credentials - not sure how long Kerb tickets are good for in this scenario.

This is amongst the reasons that you don't want to have a single DC in any AD domain. This is black-and-white Microsoft best practices.

This also has nothing to do with VMware ESXi. With the caveat that if you're in a multi-host environment and it depends on DNS for its operations like DRS and HA, those will also fail.

Improve this answer
1
  • Default Ticket Lifetime is 600 minutes, so thats 10 hrs. Can be changed by policy but sounds reasonable.
    – MaCuban
    Feb 4, 2016 at 3:10

Not the answer you're looking for? Browse other questions tagged .