Re: Multi-Site, Single Domain
- From: "Joe Richards [MVP]" <humorexpress@xxxxxxxxxxx>
- Date: Mon, 24 Jul 2006 17:15:42 -0400
First off, in a single domain forest, make all DCs into GCs, there is no reason not too as there is no overhead and every DC can do full authentication.
Second off it should be a GC since it is your DR site... Without a GC at your DR site if you are in native mode, normal users wouldn't be able to log on if there were a true disaster.
Finally, the machines should be using the DCs in their site unless there is a problem with those DCs at which point the machines will try other machines in the site and if none are found functioning it will go outside of the site. Assuming everything is configured properly this is how it should work.
What do you mean by SERVER$ entries? Do you mean sessions? If so, that doesn't mean the SERVER$ machine is authenticating against the DC. The only way to figure that info out is to use nltest /dsgetdc:domain or look at the logonserver environment variable. The sessions could be from any number of other things.
--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net
---O'Reilly Active Directory Third Edition now available---
http://www.joeware.net/win/ad3e.htm
Nick wrote:
I currently have 3 AD servers in my organization 2 are GCs and the other offsite is used in the event of a disaster which is not a GC. I have 2 sites configured in the sites and services and two subnets (1 for my default location, & 1 for the disaster site) In running nltest.exe /SERVER:someserver /dsgetsite I can see that my servers are showing up in their correct sites. I am noticing a lot of SERVER$ entries on my disaster recovery site DC from servers at the default location. Is there a way to adjust my settings so that the servers do not go across a slower VPN link for authentication purposes? I read it was not recommended to switch the LDAP priorities on the DCs, but I was not sure how true it is. Should servers in SITE1 go to SITE2 for authentication if DCs in SITE1 are available?.
- Prev by Date: Re: Information conflict: Get Group Vs. Active Directory
- Next by Date: Re: GroupPolicy reconnect from original client only Policy&Termina
- Previous by thread: Re: Information conflict: Get Group Vs. Active Directory
- Next by thread: slow user search in 2 trusted domain (one-way, not transitive)
- Index(es):
Relevant Pages
|
