Adding 2nd DC to the domain from a different subnet over VPN. -UPDATE: Not working!

domain-controllervpnwindows-server-2008

I'm in the process of adding a second DC to our domain and just want to make sure I have all the steps right before proceeding.

Info:

DC1 is 2008 R2 Standard.

DC2 is 2008 R2 Standard. //Edit: DC2 is 2008 Standard.

Network1 is 192.168.39.x/24

Network2 is 10.0.0.x/24

VPN is Sonicwall.

The 2 DC's will be at two different sites, but the networks are connected by hardware VPN. (Sonicwall). The main DC server will be on the 192.168.39.0/24 network. The 2nd DC will be on 10.0.0.0/24.

Here are the steps I plan to take; please let me know if I'm missing anything.

Part 1:

AD Sites and Services on DC1, create a new site and subnet for DC2. (Or should I create a new one for both?)

(Can I use the default IPSiteLink and not change anything in there other than refresh timer?)

Part 2:

Point the DNS of DC2 to DC1. Run /forestprep and /domainprep (on both, or just DC1?).

Dcpromo and select "Additional Domain Controller for Existing Domain". Then continue with normal steps with default locations for databases.

EDIT: Didn't realize this was like reddit and required two skipped lines to skip one 😛

EDIT 2: When DCPromo-ing DC2, do I need to have "Append primary and connection specific DNS" and "Append parent suffixes of the primary DNS suffix" checked?

EDIT 3: I started the process of joining the domain when I came across the error, "The functional level of the domain or forest is incompatible with this operating system."
"The version of the OS is incompatible with the current domain functional level"

Solved: I had to downgrade the functional level of the domain AND the forest following these steps + the small change in syntax provided by the user in comments below.

http://www.fixkar.com/articles/kb/1151/

Thanks all for help.

Best Answer

  1. You should have ADS&S configured for all sites/subnets, even when you have only one. No need to change the replication settings unless you have specific needs/limitations.

  2. No need to run /forestprep or /domainprep.