If I have Windows PCs that are joined to a domain and the domain controller goes offline, what kind of behavior can I expect on the clients (assuming there is no second DC?)
-
Will users be able log on? Or perhaps a better question, how does login functionality change, if at all?
-
Obviously file shares on the DC won't work, but what about shares between clients, or between them and a member server?
-
Once the DC has recovered, do the clients need to restart, log off/log in? Are there any long term consequences from being disconnected from the DC?
Ultimately I'm interested in what complaints I should expect to receive from users if the DC is offline. Feel free to mention any other important information that I haven't covered.
Best Answer
Quite a few things will happen with no DC available:
If the domain controller is the only DNS server, the first complaint you will get is that the internet is broken, because the clients have no DNS.
Since DC's usually also run DHCP, computers won't be able to connect to the network at all. Computers that are already connected will keep working for awhile.
Files shares they are already connected to will work fine for awhile (a few hours likely), until their session expires. When the file server goes to validate their credentials, it won't be able to talk to the DC, and won't let anyone connect anymore.
Anything else that relies on active directory authentication (like IIS sites, or VPN servers, etc) won't let people login. Depending on the setup, it might immediately kick people off, or might keep existing sessions and just not allow new ones.
For the computers themselves, people who have used the computer recently will still be able to login. People who haven't used the machine before, or used it a long time ago won't have any cached passwords, so they won't be able to login until the connection to the DC is restored.
There are long term consequences to being disconnected from the DC - eventually nobody will be able to login with a domain account, because the cached passwords will have all expired. If you are unable to reconnect to the DC, and don't have any local accounts enabled, you can end up in a situation where you need to use utilities like NTPasswd to enable the local administrator account.
The best practice for domain controllers is to have at least two if them. So much in a windows network relies on active directory that you need the redundancy. For a smaller organization, it can share roles with file servers, though avoid having a domain controller share a server with things like sharepoint and exchange (it makes restoring and upgrading them very tricky to do properly)
With two domain controllers, if one dies, you can just reinstall windows server, set it up as a new domain controller in an existing domain, and off you go. No downtime at all. With a single domain controller restoring can be tricky. And while you're restoring, you have people upset that they can't do anything.