1

I have a really stupid question for you all. I have 4 DCs in a 400 workstations 3 of my domains are server 2003 and one is 2008 R2. So I’m not really to sure how the DC work and I Recently took over doing the System Admin job here. Well we are running AD 2003 still. I am looking to upgrade to 2008 in the near future.

The question I have is do I really need 4 DCs for a domain that has only 400 Workstations.

the second part of this question is How can I tell what roles each DC have.

the reason I ask this is because here comes the 3rd Question I have is I have notice that all my Workstation connect to different DCs and the understanding that I have always had was everyone Connects to the PDC and the Secondaries are only for fail over support such as if the PDC fails.

So I guess this is the 4th question I have for you. Am I right in my thinking about the Users authenticating with the PDC and should only connect to another DC if the PDC fails?

I found all this out in the Last few days when I discover that I have have replication issues and Some workstations weren’t able to get GPOs.

I thank you in advance for helping me with this I’m still learning the whole AD world One step at a time.

4 Spice ups
2

In 2000 and later all DCs are peers, so users will authenticate to any DC which is close to them and online. Are all your systems at one site or are they multiple places? You should have at least 2 DCs for redundancy, but 4 on a single site may be overkill.

3

We have 3 on site and one is our Mail server… Was done years before I ever worked here. and we have a jail across town about 5 miles away that has a DC there and they double that domain Controller as a printer server.

4

To determine FSMO roles do the following:

How to Determine the RID, PDC, and Infrastructure FSMO Holders of a Selected Domain

  1. Click Start, click Run, type dsa.msc, and then click OK.
  2. Right-click the selected Domain Object in the top left pane, and then click Operations Masters.
  3. Click the PDC tab to view the server holding the PDC master role.
  4. Click the Infrastructure tab to view the server holding the Infrastructure master role.
  5. Click the RID Pool tab to view the server holding the RID master role.

How to Determine the Schema FSMO Holder in a Forest

  1. Click Start, click Run, type mmc, and then click OK.
  2. On the Console menu, click Add/Remove Snap-in, click Add, double-click Active Directory Schema, click Close, and then click OK.
  3. Right-click Active Directory Schema in the top left pane, and then click Operations Masters to view the server holding the schema master role.
    NOTE: For the Active Directory Schema snap-in to be available, you may have to register the Schmmgmt.dll file. To do this, click Start, click Run, type regsvr32 schmmgmt.dll in the Open box, and then click OK. A message is displayed that states the registration was successful.

How to Determine the Domain Naming FSMO Holder in a Forest

  1. Click Start, click Run, type mmc, and then click OK.
  2. On the Console menu, click Add/Remove Snap-in, click Add, double-click Active Directory Domains and Trusts, click Close, and then click OK.
  3. In the left pane, click Active Directory Domains and Trusts.
  4. Right-click Active Directory Domains and Trust, and then click Operations Master to view the server holding the domain naming master role in the Forest.

As far as redundancy, it is always best to have at least two DC’s. I have four running in my network and there are never any problems. You can also use dcdiag /test:replications to test AD replication as well.

1 Spice up
5

Mike With the replication I notice that in Ad Sites and Services that For each DC they only sync to 2 other DC rather than all 3 I’ll post a pic so you can see what I’m talking about.

scdc01.png
scdc01.png768×537 61.7 KB
6

See this other one is set to replicate to 2 other ones as well. With the way it is now It’s set for all DCs to replicate between each other I just don’t understand why They wouldn’t have each DC replicate with all 3 other DCs. should It be set to replicate with all 3 other servers or is it fine the way it is? thats the question I don’t know

scdc02.png
scdc02.png768×537 61.6 KB
7

here is the 3rd DCs

scdc03.png
scdc03.png768×537 61.8 KB
8

4th DCs

mail1.png
mail1.png768×537 62.4 KB
9

The settings look fine. You want automatically generated site connectors. This means that AD is working correctly. You can use the DCDIAG command I sent earlier to check and make sure the AD DB is in sync on all DC’s.

10

I would have at least two at the data center and 1 at each branch otherwise logons will be slow. but since you have one site i would recommend two. I have never had trouble with Intrasite replication.

11

You say one with mail server on?

Is that Exchange? and a DC?

I think the general rule of thumb is to not have the mail server on a DC

But… I may have the wrong end of the stick with your setup

1 Spice up
12

Yeah those settings look fine - you don’t need every DC directly replicating with every other DC, they just all need to be connected indirectly. So if DC 1 replicates with DC 2 and DC 2 replicates with DC 3 then indirectly DC 1 is replicating with DC 3, if that makes sense. Generally you just leave AD to sort it out itself, which is what it looks like it is doing for you because you have those auto generated connections. In my experience on networks your size it is very rare to need to mess with the replication settings and connections.

As for 4 DCs for 400 workstations, you could probably get away with just a couple at your main site and one at your other site 5 miles away (splitting the FSMO roles between them) but having an extra one certainly isn’t going to do any harm.

Someone already explained how to determine which DCs have which FSMO roles so I won’t go over that again

13

Oh and one thing you might consider doing though is creating a new site in AD Sites & Services for your site that is 5 miles away, as I’m assuming the connection between you and them is not as fast as normal LAN networks so you don’t really want users on your site being authenticated by the DC over there (and vice versa). Assuming the other site has a different subnet for their LAN then you can just create a new site and a new subnet in AD sites & services and move the relevant DC into there, then AD knows which DCs to authenticate which machines against. Of course if the DC over there dies then users over there would fall back to authenticating to DCs on your site still regardless of how sites & services is setup.

Also just noticed your last line about saying you have replication issues - this tool might help you find out exactly which DCs are having problems: http://www.microsoft.com/en-us/download/details.aspx?id=30005

“Am I right in my thinking about the Users authenticating with the PDC and should only connect to another DC if the PDC fails?”

No as Justin mentioned, in Active Directory all DCs are pretty much equal so users can authenticate with any of them. One DC in each domain has a special FSMO role though called the PDC emulator role, and this performs a few special duties which are summarised here: [MS-ADTS]: PDC Emulator FSMO Role | Microsoft Learn