3

I am designing a solution to move users to Office 365 / RemoteApp With a Dirsync connection back into the on site AD servers to handle local logins / local file server.

The plan is to have two Hyper-v servers (for resilience) for local Linux based apps and to also house the Active Directory servers on them. The problem is that Hyper-v would need to be a member of the domain it is running as a guest.

It could be possible to run an AD server on Azure basically just for these servers to authenticate to while they boot, but that seems complicated.

Ideally we just want to have those two servers on site. Is there a way around this that I'm missing?

So if the only AD servers that are available are Hyper-v guests, and everything is initially turned off. How do I start the (domain member) hyper-v servers, before the Domain Controller guests that they are running have started.

  • Anti-affinity, however Hyper-V handles that. – Michael Hampton Apr 14 '16 at 12:57
  • Creating an Anti-affinity rule for the Domain Controllers is going to be useful when you have 3 or more cluster hosts. If you have a single host failure in a 3 + cluster then the Anti-affinity rule will keep the Domain Controllers separated. With only 2 cluster hosts there's no choice but to place both Domain Controllers on the same host if you have a single host failure. The other scenario where an Anti-affinity rule is useful is if you deploy SCVMM and implement Performance and Resource Optimization. – joeqwerty Apr 14 '16 at 23:15
3

Windows Server 2012 R2 Hyper-V Failover Clusters support DC-less bootstrapping, so the Cluster will bootstrap without needing a DC to be available, so there's really no "chicken or the egg" scenario. There's really no need for an Active Directory-detached cluster. Create your DC VM's, create your AD domain, join the Hyper-V hosts to the domain and create your Failover Cluster.

| improve this answer | |
  • It was the 'DC-less bootstrapping' that was the key to searching for it properly. It also seems that if you're booting while DC-less, you need to start up in the reverse order you shut down, else the quorum won't come up. – Michael B Apr 14 '16 at 21:58
5

The answer lies here: Deploy an Active Directory-Detached Cluster

In Windows Server 2012 R2, you can deploy a failover cluster without dependencies in Active Directory Domain Services (AD DS) for network names. This is referred to as an Active Directory-detached cluster. Using this deployment method enables you to create a failover cluster without the previously required permissions for creating computer objects in AD DS or the need to request that computer objects are prestaged in AD DS.

So it is not a chicken and egg scenario anymore. There are limitations, though. One of them being that Live Migration is not supported.

| improve this answer | |
  • So if the only AD servers that are available are Hyper-v guests, and everything is initially turned off. Will that allow them to start up, and then start up the AD server guests, and continue normally? – Michael B Apr 14 '16 at 13:04
  • I never installed one, but yes, that is my understanding on how this works. Be sure to read the docs and maybe someone else will comment with experience, too. – Daniel Apr 14 '16 at 13:09
  • yes it will allow them to start up and start the guests and continue normally. but you don't need an AD Detached cluster to do it. do you plane on clustering your host servers? – Michael Brown Apr 14 '16 at 14:21
1

Hi as stated by some of the other contributors this really isn't a problem today. First of all I would always consider Clustering the Hyper-V hosts, you will need shared storage to host your VMs but it will give you protection in the event of a failure, secondly make sure that the two DCs that you deploy as VMs are placed on separate hosts. under normal operation Hyper-V host 1 will run DC1 and Hyper-V host 2 will run DC2.

If you decide to install a failover Cluster you do not need to deploy an AD Detached cluster as stated in the other answer, you might decide to for other reasons but not for the reasons in your question. a normal attached cluster will do.

finally even if you decide not to cluster your Hyper-V host servers you can still domain join them and place one DC on host one and the 2nd DC on host two. I would consider making sure the startup behaviour of the DCs is set to Always start this Virtual Machine Automatically, think about using live migration if oyu want to bring a host down for maintainence and only bring one Hyper-V host down at a time.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.