0

Where I work we currently have 1 domain controller for around 35 PCs. It is a virtual DC running off Hyper-V on our Server.

We also have other VM'S for Exchange, Apps etc.

Do we need to have 2 DCs? Would it be beneficial to us to have 2 with one as a failover if something happens to the 1st one ?

Dave M
  • 4,514
  • 22
  • 31
  • 30
GamerGypps
  • 113
  • 6
  • Well it depends... Can you live with networking issues like login, windows shares and group policy stop working as intended if the primary domain controller goes down? If you have a backup domain controller, you could just promote it to be the primary domain controller. – Lasse Michael Mølgaard Dec 16 '19 at 12:41

4 Answers4

3

Yes, you should have two Domain Controllers.

If your one Domain Controller goes down users will be unable to log in to the domain, access resources in the domain, won't have access to their Exchange mailbox, etc.

If your one Domain Controller dies and is unrecoverable you will essentially lose your domain... which will necessitate recovering data, mailboxes, creating a new domain, joining your domain members to the new domain, etc.

joeqwerty
  • 109,901
  • 6
  • 81
  • 172
2

It's always good to have redundancy in your network, but if everything is in a single hardware, I would say it is better to invest in a good backup and snapshot policy.

Stefano Martins
  • 1,221
  • 8
  • 10
1

Two or more AD DS domain controllers active at all times.

AD DS is a replicated database where many things are possible on a replicated DC: login, group policy deployment. Should a "primary" be lost and multiple DCs exist, end user functions continue, while operations masters roles can be moved easily.

John Mahowald
  • 32,050
  • 2
  • 19
  • 34
  • I see. Apologies i am new to this and have been thrown into the deep end a bit. Does it matter if the DCs are virtual or physical at all ? – GamerGypps Dec 16 '19 at 13:44
  • 2
    I personally would recommend at least 1 physical - just in case your virtual stack relies on AD auth to access and something happens with the virtual AD server, but that's just my opinion. – Smock Dec 16 '19 at 13:52
  • 1
    Virtual or physical is fine. Creating DCs is fairly easy. But consider some professional assistance in defining recovery procedures, and help with design. – John Mahowald Dec 16 '19 at 13:54
  • 1
    What joeqwerty said, and I also agree with Smock because I've personally seen a virtualization environment refuse to start because one of the dependencies was virtualized and loaded after the virtualizaion environment. – Katherine Villyard Dec 16 '19 at 21:41
0

The answer is entirely about risk management and availability, so you need to look at what your requirements are and decide if the answer is 1, or 2, or more.

1 DC will do everything that 10 will do, so you do not strictly need more than 1 even for very large environments with hundreds of users. Many people automatically jump to two, however very often this is without actually looking at requirements and costs.

Do you need it to be available 24x7? At a minimum you will need to add a second one, as the first one will need to be rebooted from time to time.

If it fails, what are your recovery point objective, and recovery time objective? Since it is a virtual machine you may setup checkpoints such that you can restore to last night or the last hour in a few minutes or less, so you might not need a second DC for recovery purposes. (Note since you comment you are new... never ever checkpoint a DC once you have 2 or more... recovering a replicated DC is a much more involved process than other servers and checkpoints will hurt you).

Since it would presumably be virtualized you should also look at whether 2 DCs on a single host provides the redundancy you need (disk failure, motherboard, CPU, etc.). Having 2 DCs will not help if your single virtualization host is filling the room with smoke.

Are you worried about a flood wiping out your office? Maybe that would be a good reason to have a second DC that is located in a remote cloud such as AWS or Azure.

Also look at the cost of an additional license and memory, and the cost of the additional complexity. You may be spending thousands of dollars on licenses, hardware, and operations (you need to monitor replication, and it is common for junior people to mess it up resulting in failures and hours of cleanup) for something that is just not worth it. A working backup may do everything you need to get from a second DC.

I happen to run 4 DCs for myself alone. 2 on-prem in my home office, and 1 in each of 2 different Azure data centers. For a small office today I would very likely recommend 1 DC on-premises and a second DC in the cloud, as a small cloud server can be under $20/month which is "free" compared to my time.

Doug
  • 962
  • 4
  • 7
  • Thank you for the detailed reply. My Boss has recently left leaving me, a junior with only a years experience in Active Directory the sole IT person at my company. I am expected to take on everything and understand how it works and fix any issues as they will not be replacing him. We do not need 24/7 availability so small downtime is okay especially in evening and weekends. We already have an offsite backup of the server and VMs i belive that go to a spare server at a directors house. – GamerGypps Dec 17 '19 at 10:42