2

I have two public dedicated web servers that I want load-balanced using windows NLB. I want to take advantage of DFS replication to keep all my files in sync between the two servers.

To do this I need to configure Active Directory, which also requires DNS Server to be installed.

I know I'm a little over my head here, but hopefully I can get some answers on how to correctly set this up.

Can I use the 'dcpromo' wizard to setup a domain controller and DNS Server on my server?

What should I use for the FQDN, my public domain name (DNS setup externally) is house-mixes.com, should i use something different such as house-mixes.local?

Would installing the DNS server affect anyone accessing my web server to view the house-mixes.com website?

I just want to ensure I don't deny myself access to the machine after configuring and rebooting.

UPDATE:

A few of you have pointed out that DFS may not be ideal in my situation, well I will explain my scenario a little more to hopefully find an elegant solution.

I am load balancing for 2 reasons, high availability and to spread the load (it's a pretty busy website).

Each of the 2 servers are identical both with around 10TB of the same data, an average of around 10-15gb of new data gets uploaded by users of the site each day, as well as a few GB deleted, files are never modified...just created or removed.

I need the uploaded files to be replicated pretty much instantly to the other machine otherwise the media files will work on one machine and not the other until they are in sync.

At the moment I have a SQL server database installed only on one of the machines, I do want to setup another SQL server as a backup on the other machine, but I will leave that for another question.

At the moment I am using some software called ViceVersa Pro, which is basically what rsync does but has the ability to do this when any file changes are recognised. This software has worked ok so far, but I was looking to try and do this without any third-party applications if possible.

Thank you!

Paul Hinett
  • 1,205
  • 3
  • 11
  • 19
  • Just in case you didn't know, DFS replication is not instant. Are you ok with the DFS replication lag that will cause your sites to be out of sync for a while? – Tatas Feb 22 '11 at 14:30
  • ah! no i presumed it was instant...is there a better way to do this? – Paul Hinett Feb 22 '11 at 17:56

3 Answers3

4

Your comment "...ensure I don't deny myself access to the machine..." causes me to suggest, first, that you really should mock this up using virtual machines in a lab before you begin working on your real production machines.

dcpromo is the tool use to "promote" a stand-alone Windows Server machine into being a Domain Controller (DC). Being the first DC in your Active Directory (AD), you will be prompted to install the Microsoft DNS Server onto the machine during promotion. The machine will be configured to refer to itself for DNS. It should use itself and only itself for DNS (until you promote a second domain controller, at which time the 1st DC should have the second DC specified as a DNS server and the converse).

Microsoft's recommendations re: AD domain names are a good first item for you to read. The "tl;dr" version is that you should be using either a subdomain of a domain you already own (ad.domain.com), or a domain name you own that isn't in use for public Internet services (someotherdomain.com).

Using your "real" public domain name (which Microsoft and I recommend against) creates a "split horizon DNS" situation where the DNS servers responsible for the AD believe they're authoritative for "domain.com" while other DNS servers that run your public Internet presence think they are authoritative for "domain.com". As a result, you get the make-work job of synchronizing "A" records between the DNS servers for "domain.com" services that need to be accessible to both servers that a members of the "domain.com" AD domain and Internet users.

I'd name the AD domain something like "ad.house-mixes.com" and go from there.

Your servers that will be members of the AD domain need to have only DNS servers specified in their own TCP/IP configurations that are running on DCs. If you only have a single DC (which, itself, is not a good idea) then the member servers should only have the IP address of the DC (which will be running a DNS server) specified as their DNS server.

The public shouldn't be able to access your DCs' DNS servers. Being accessible to the public doesn't create a security vulnerability, per se, but it can leak information. You don't want potential attackers learning anything about your AD configuration via DNS.

Third-parties accessing your web site are directed there by, presumably, some already-existing authoritative DNS server. As long as that's left intact the domain membership of the web servers (and what DNS server they're using for queries they generate themselves) won't cause any change in the public's ability to access your web site.

Evan Anderson
  • 141,881
  • 20
  • 196
  • 331
  • This, is not completely true. On windows, if you perform a DCPROMO on an completely new server, it will ask you to: Make a new Forest/Domain. or Integrate itself on an existing domain. The setup is able to perform a complete install of a new domain. About the DNS, It should be the first part of your architecture, you should install it before any other part of your IT stuffs. – Dr I Feb 22 '11 at 16:57
  • 2
    @Dr: There's no part of my answer that's untrue. I didn't provide a lot of detail information because I assumed the OP wanted to create a simple single-domain forest and didn't have any existing AD forests / domains. Yes-- DCPROMO will let you join an existing domain. It's still the utility used to promote a stand-alone server into being a domain controller, though. re: DNS - I prefer advising users to let DCPROMO install / configure DNS as it takes fewer steps and always configures itself properly. I would _not_ advise someone in the OP's situation to install the DNS Server role manually. – Evan Anderson Feb 22 '11 at 17:04
  • In this case, I'm agree with you, I though you just forgot this point or maybe didn't knew it (sometime I miss some UI tricks because most of my time I'm working with CLI) ;) – Dr I Apr 27 '11 at 19:31
0

DFS is not going to be the best solution because it requires a Windows domain, as the other posters have described.

You can do this a number of ways, depending on why you have two webservers. Is it because your site gets so much traffic that you need two? Is it for redundancy only?

Without knowing more, I would recommend storing your files on a NAS (or another server) and having both webservers point at that NAS. That way you only have to change your files in one location.

Jeremy
  • 938
  • 2
  • 7
  • 18
  • Hi Paul - thanks for updating your question. I believe a NAS solution is best for you, so you only have to maintain one copy of your data. If you try and synch both in real time you are going to need something more powerful than rsync or robocopy - neither is designed to support two way synch and instantaneous replication. Put your files on a NAS and point both of your web servers to that NAS. This is the architecture you should be using, I think. – Jeremy Feb 23 '11 at 13:19
  • well the reason i was keeping 2 copies was for backup reasons too, if we was to lose the 10TB of data for any reason then it would be a disaster. Ok the other server is in the same datacenter, but it at least covers me if 1 of the servers was to completely die, or one of the drives. – Paul Hinett Feb 23 '11 at 23:25
  • Honestly, you should still get a NAS and then use a backup application to back up your NAS - you could even back it up TO one (or both) of the existing servers. But both servers should point at one single file store. – Jeremy Feb 24 '11 at 15:42
0

Rather than setting up DFS, you could look at something like RSync to syncronise the files between the two servers. It may be a lighter weight solution than deploying Active Directory for DFS between two servers.

http://www.rsync.net/resources/howto/windows_rsync.html gives information on some RSync programs.

Another thing to consider is how often the files change, is it work automating the copy process? Whats the business driver for mirroring the files?

ITHedgeHog
  • 654
  • 6
  • 13