Two domain controllers - yet when primary is down, domain still fails?

Question

I have multiple windows 2003 servers support a particular network, and when one particular server is taken offline, domain services begin to rapidly fail, such as users couldn't login.

What check list shall I look into to ensure that I can take my primary domain controller offline, for work, or any other reason, and have the domain still work as expected. I thought I had redundancy, but actually, it turns out that I didn't.

I'd like to look into this and figure out how to actually have redundancy for the domain services - and hints, tips, and comments very much appreciated.

Is this server also your primary DNS server? Does the secondary work properly? — SpacemanSpiff, Jan 22 '11 at 21:23
Yes, it is my primary DNS server. I have another one setup as well — Mister IT Guru, Jan 22 '11 at 21:31

score 2 · Answer 1 · answered Jan 22 '11 at 21:16

2

Please check all DC's are global catalogs. if not... a GC can not authenticate users.

answered Jan 22 '11 at 21:16

TomTom

51,649
7
54
136

I feel ashamed! I thought this was automatic?! I ran DCPromo and went through the wizard, I didn't realise that it wasn't enough. – Mister IT Guru Jan 22 '11 at 21:26
I've made another DC hold the GC as well, if I recall, doesn't this take 15 minutes or so to propagate? How can I check it's now a copy of the GC? – Mister IT Guru Jan 22 '11 at 21:43
Hm. go home, try tomorrow. It can take some time - no idea about your network structure (WAN etc involved) or how long your AD is. Possibly something may be in the event log once it is a GC. – TomTom Jan 22 '11 at 22:43
I'll check my event log, my network is 24 hours! – Mister IT Guru Jan 22 '11 at 22:49
1

Not every DC needs to be a GC server to service logon requests (it can't hurt though). I believe that is only needed to authenticate users to another domain in the forest. I would highly suspect DNS is this culprit here. – SpacemanSpiff Jan 23 '11 at 00:39
This still did not solve my problem – Mister IT Guru Jan 26 '11 at 14:09

score 1 · Accepted Answer · answered Jan 28 '11 at 13:26

I moved the FMSO roles to another server to get around the problem I had with the original server.

Authentications now work faster and logons are quicker, but I have not reached my aim of have 'complete' redundancy, but I have solved my problem doing this.

Thank You

Two domain controllers - yet when primary is down, domain still fails?

2 Answers2