RE: Need Advice (Repost)

Brian,

Thanks agiain!!!

Just one more thing. Sorry if im reading too much into what you wrote; but I
just want to make sure i have things right. When you wrote "In your current
configuration there is no preference to the prod DCs over the DR DCs" Is
there a way to setup preference to the prod DCs over the DR DCs, and if there
is, how can i check; just to make sure that in my configuration there is no
preference to the prod DCs over the DR DCs.

Shannon
"Brian Delaney [MSFT]" wrote:

Hi Shannon,

It is fine if the DR DNS servers are after the secondary DNS, as long as
the clients do have them configured.

Yes, if the DR servers are in a different AD site the users will be able to
connect to them if all the production servers are down. The difference is
that all the DCs in the production site will be tried first before trying a
DC in the DR site. In your current configuration there is no preference to
the prod DCs over the DR DCs

Hope this helps,

Brian Delaney
Microsoft Canada
--

This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
Thread-Topic: Need Advice (Repost)
thread-index: AcbAaMQNl8+S5k1tQICV0nhrLvtO5Q==
X-WBNR-Posting-Host: 216.223.52.99
From: =?Utf-8?B?U0VnZXJ0b24=?= <SEgerton@xxxxxxxxxxxxxxxxxxxxxxxxx>
References: <00F481E0-09F7-4D56-AFEC-C1F003461B1E@xxxxxxxxxxxxx>
<io02D6BwGHA.2004@xxxxxxxxxxxxxxxxxxxxx>
Subject: RE: Need Advice (Repost)
Date: Tue, 15 Aug 2006 05:46:02 -0700

Hey Brian,

Thanks for the reply! It was very helpful.

The clients machines have been configured with the DNS Servers ip
addresses
from the Disaster Recovery site, but these addresses have been placed
after
the secondary DNS Server. Currently their secondary DNS Server is the
Second
DNS Server in the production site. Should I move a DNS Servers IP Address
from the Disaster Recovery site into the Secondary DNS Server spot on the
clients machines?

I have an additional question. If I configure Active Directory Sites, and
the Production Site goes down and users can't connected to the Production
Site, will the the users from the Production Site be able to connect to
the
Disaster Recovery site that would then be in another site?

Thanks again,
Shannon


"Brian Delaney [MSFT]" wrote:

Hi Shannon,

I will try to address as many of your concerns as I can. If i miss any
points or you need further clarification please reply with the details
you
need.

Active Directory Sites should be configured in this scenario. You
should
have a site for your production servers with the associated subnets and
a
site for your DR site with the associated subnets. This will ensure
that
during normal production the users are authenticated by the correct
domain
controllers and will not need to go across the WAN connection as some of
them are likely doing right now.

Regarding your failover test when you shutdown your production servers.
Have your client machines been configured with a secondary DNS server
which
is located in the DR site? If the clients are only pointed at local DNS
servers and you have shut them down then logons will become slow. These
machines will need to point to a DNS server in the DR site as well as
the
production site. Regarding your logon scripts, did you try to run these
at
the desktop to see if any errors were generated by the scripts? If so
what
were the errors? Ensure that any references to the netlogon share in
your
logon scripts are \\domain\netlogon instead of \\dc\netlogon

In regards to "My manager would like to use our Disaster Recovery site
as
our only source of redundancy": I would hope and recommend that regular
backups are also part of your DR planl. Although your DR site will help
you if your local DCs go down, it will not help you in the case of an
accidental deletion of user/computer accounts or data. In this case a
restore from backup may be required. Also, please note that rolling
back
the hard disks is not supported by Microsoft on Domain Controllers.
This
feature is known as Undo Disks in Virtual Server but I believe has a
different name in VMWare. Rolling back disks on a DC will cause a USN
rollback (http://support.microsoft.com/kb/885875/en-us).

As for the userenv 1030 and 1058 errors on your domain controllers. If
these are occuring every 5 minutes on DCs then there is a legitimate
problem but if they have only occured once then it was probably just a
temporary condition. These errors are fairly generic and can mean
different things. If you are experiencing them regularly please copy
and
paste the entire event description so I can see the actual error code.


Hope this helps,

Brian Delaney
Microsoft Canada
--

This posting is provided "AS IS" with no warranties, and confers no
rights.
--------------------
Thread-Topic: Need Advice (Repost)
thread-index: Aca/vjGT6tG6WyQ6Qpa++JlP7JZ5Cw==
X-WBNR-Posting-Host: 216.223.52.99
From: =?Utf-8?B?U0VnZXJ0b24=?= <SEgerton@xxxxxxxxxxxxxxxxxxxxxxxxx>
Subject: Need Advice (Repost)
Date: Mon, 14 Aug 2006 09:25:02 -0700

Im relatively new to Active Directory. I've been posting questions in
here
for the last couple months and things are coming along slowly. Things
are
working out well, you guys have been of great help. But before i go too
far;
I just want to make sure im running things correctly.

I need advice about my configuration of my Active Directory domain and
its
structure. All my Servers are Windows 2003 Server. What im in the
process
of
doing is, converting our Novell Network (that is used only for File and
Print
share) to Active Directory. Im not concerned at the moment about the
conversion; I've already done test runs on this and know how to do
this.
At
the same time that im building this new Active Directory domain, im
also
setting up a Disaster Recovery Site for this domain. We have purchased
all
our equipment and are using VMware ESX software to build our servers.
Our
Production site and our Disaster Recovery site are in different states
and
are connected by way of a T1. Both networks are also in different
Subnets.
We
have also purchase NSI Double Take software to replicated our file
server.

This is what i've done so far. I've built two Active Directory Domain
Controllers in our Production site and a File Server that is a Member
Server
of the domain. Both Active Directory Domain Controllers are also Active
Directory Intergrated DNS Servers.

Then I built two additional Active Directory Domain Controllers in our
Disaster Recovery site. I just added them to the same domain. These
additional Active Directory Domain Controller are also Active Directory
Intergrated DNS Severs. Then I also built an additional File Server
that
is a
member server of the same domain.

All Active Directory Domain Controllers in both my Production site and
my
Disaster Recovery site are Global Catalog Servers. I have the NSI
Double
Take
software installed my both my File Servers for replication. I've also
tested
this software and it is working out well.

No roles have been moved from any servers. Therefore, my understanding
is
that my first Active Directory Domain Controler is holding all the
roles.

I set up the network this way, so in the event of a disaster; my
network
will be replicated in my Disaster Recovery site. I've done some test
runs
and things worked, but not 100%. After I shutdown my Production Site,
the
Double Take software notice the network went down and took over. That
part
worked great. But for the Acitve Directory Domain, logins took longer;
logon
sctipts seem to take a long time to map and they didn't seem to work
correctly. I used IFMember commands in my scripts and it didn't
reconize
this
command when the Production site went down, but it did see all the Net
Use
commands and Mapped all drives for all groups for one user. Even
mapping
for
groups the user isn't in.(At the moment everyone has rights to all
files
on
the File Server. I will change this later). But when the Production
site
is
up, the IFMember command works and they only get their asigned
mappings.
When
i placed the IFMember command in the Netlogon folder on the first DC, I
did
notice it replicate to the other servers. So way wouldn't this work?

Today i notice that i was getting errors in my event logs of my first
domain
controller. These error were posted at times when both sites were up
and
everything seemed to be working well. The error ID's were
Type: Error
User: NT Authority\System
Computers: MY First Domain Controller
Source: Userenv
Category: None
Event ID: 1030

Type: Error
User: NT Authority\System
Computer: My First Domain Controller
Source: Userenv
Category: None
Event ID: 1058

Then on a final note. My manager would like to use our Disaster
Recovery
site as our only source of redundancy for our VMWare Server. I didn't
mention
this before, but All three servers in our Production Site Reside on a
Storage
Array connected to only one server running VMWare. So if this server
should
fail, then all three servers will go down, and he would like our users
in
our
production site to connect over the T1 to the remaining two Active
Directory
servers and the File server in our Disaster Recovery Site. Another
scenario I
can think of would be if only the File Server in the production site
went
down, then users would connect to the File Server in our Disaster
Recovery
site.

After having all these issues and thoughts; I got to thinking, about
Sites;
but im not familar with them. All my server are in the same domain and
the
same site. Should i have created two different sites within the same
domain.
This is what got me thinking to open this post.

From all my reading about Active Directory, i believe i setup the
domain
correctly; but im unsure whether or not i should have created two
different
sites under the one domain. I am unfamilar with this.

Any comments on my configuration of my Active Directory Domain and its
structure will be appriciated.

At first our DR site was only in place if a major disaster happened
(Users
couldn't work from the Production Site for whatever reason). Now my
manager
wants to use it any time there is a disruption at our Production Site.
So,
should the VMWare server go down, then all of our Production Servers
would
go
down and he would like users to connect from the production site to the
DR
site. Remember, All the production servers are on one Storage Array
connected
to the one VMWare Server. This is the same setup in the DR site. The DR
site
only hosts the two Active Directory Servers and One File Server. There
are
about 15 workstations sitting there in the event of a major disaster
and
users have to work from there. Otherwise, no users should connect to
these
server unless one of these situations happen. The file server in the DR
site
is only replicating the file server in our Production site using NSI
.

Relevant Pages

  • RE: Need Advice (Repost)
    ... the prod DCs over the DR DCs is because sites have not been configured. ... Active Directory Sites should be configured in this scenario. ... I need advice about my configuration of my Active Directory domain ...
    (microsoft.public.windows.server.active_directory)
  • Re: Replacing NT4 with AD
    ... > We are about to convert our NT4 systems over to a new Active Directory ... upgrade, If you choose the BDC promote it to PDC, then run your ... As for the question about where to site the DCs, ... Global Catalog servers. ...
    (microsoft.public.win2000.active_directory)
  • Re: W2K to W2K3 AD
    ... Pete it sounds like you are about to replace the Windows2000 DCs to Windows ... the new DCs to Global Catalog Servers. ... http://www.chrisse.se - Active Directory Tips ... > bring w2k3 dc into domain ...
    (microsoft.public.windows.server.active_directory)
  • Re: Need a link to setup redundant DNS in same LAN
    ... >> Is this an Active Directory domain? ... >> Forest Wide replication all you need is DNS ... >> installed and to store the zones in Active Directory. ... >> least all DCs in the domain and do not require action ...
    (microsoft.public.win2000.dns)
  • Zone Transfers in 2003
    ... I had two Win2K AS servers running hosting a single active directory domain ... should and then they'd both pull copies of the secondary zones from the ...
    (microsoft.public.windows.server.dns)