Primary AD Domain Controller – What to Consider When Rebuilding

domain-controller

I just did some search such as this one and this to avoid asking a question which already has answer.

However, I'm not sure whether the information fully match my question or not.

The situation is, I'm currently maintaining a test environment under a business domain. There are two windows 2016 AD domain controllers acting as primary DC and second DC respectively, and are apparently linked together to provide domain services.

These two domain controllers only have basic roles running: domain services and dns, and all the nodes/clients in this domain are managed by them.

Now, the primary DC encountered unexplainable issues and I have no choice but to delete the whole machine and rebuild a new primary DC to replace it.

I have no experience on "rebuilding" the "primary" domain controller, does anyone know what to be aware of when doing such thing? Or maybe I can just delete the primary DC and recreate it without making any changes on second domain controller?

thanks in advance.

Best Answer

Notice that while you designate one of your controllers as "primary", there is no such concept in the Active Directory technology. The NT4 "PDC" functionality was essentially split a "primariness" into several Flexible Single Master Operation (FSMO) roles, which can be assigned to different DCs, and then there will be no signle controller which can be designated "primary" at all. That was done 22 years ago, and yet many people still use ancient and irrelevant NT4 terminology!

So, the general DC "rebuilding" strategy applies. After each step you should check your replication is consistently working, and group policies on the SYSVOL share are available. You begin by fixing replication issues (if any), then move all assigned FSMO roles away from the controller you are about to demote, and then you demote it, updating DNS. After reinstalling and promoting a new DC you may reassing some FSMO roles to it or leave them where they are — it doesn't matter much.

Related Solutions

Risks of having only one domain controller

First of all, you're looking at things wrong. You're running Exchange and other services on your server as well as Active Directory and DNS. You're doing it wrong. You really want Domain Controllers to only run Active Directory and DNS. You'll run into serious performance issues down the road if you get a medium number of mailboxes in Exchange and it runs on a DC.

That being said, downtime is a real issue. Is your boss OK with users not being able to log in, access file shares, access other SSO technologies that you might leverage for the hours that it will take to do a restore? If you have two DCs (or more) and you have exchange and file services running on separate servers like you should be, then this becomes a very real problem.

As it is, it seems like you already have all of your eggs in one basket, which is a really really bad position to be in. You should be pushing for a dedicated Exchange server, a 2nd DC, and possibly a file/print server. This, of course, depends on the number of users that you have. Even if you do keep Exchange and any file\print services on your existing DC, if it goes down, your network users won't even be able to log in to their machines to even have basic Internet access.

Finally, seizing the FSMO roles is trivial. As long as both DCs are Global Catalogs, you don't even really have to transfer the roles if you're going to be fixing the downed server immediately anyway.

You're already in a bad position. You should be working towards rectifying it by adding the additional infrastructure that you need to eliminate all-or-nothing downtime, not throwing your hands in the air and saying "well we're pretty much screwed anyway."

DNS – Optimal Order of DNS Servers for an AD Domain Controller

According to this link and the Windows Server 2008 R2 Best Practices Analyzer, the loopback address should be in the list, but never as the primary DNS server. In certain situations like a topology change, this could break replication and cause a server to be "on an island" as far as replication is concerned.

Say that you have two servers: DC01 (10.1.1.1) and DC02 (10.1.1.2) that are both domain controllers in the same domain and both hold copies of the ADI zones for that domain. They should be configured as follows:

DC01
Primary DNS   10.1.1.2
Secondary DNS 127.0.0.1

DC02
Primary DNS   10.1.1.1
Secondary DNS 127.0.0.1

Best Answer

Related Solutions

Risks of having only one domain controller

DNS – Optimal Order of DNS Servers for an AD Domain Controller

Related Topic