Hyper-V Role on a Domain controller

[techie08]

Not sure if this has been covered, but is anyone running the Hyper-V role on a 2008r2 domain controller? I was thinking of doing this but someone said it isn't supported by microsoft.

I thought for a primary school, this would be ideal!!

[PiqueABoo]

Not sure about support but I would always want the host/parent to be completely independent of any VMs it is running i.e. just dedicated to running, and occasionally managing those VMs.

 

And part of the point is to be able to easily pick up VMs up and have them working on another server when the first one fries in that stationary cupboad on hot summer day or something, which you couldn't if they relied on that DC on the original server.

 

I thought for a primary school, this would be ideal!!

 

What function did you have in mind? As in what would you run in a VM on that DC?

[Arthur]

According to the articles I have read; current best practice is to have at least one physical DC that acts as your forest root. The article linked below explains the other options though.

 

The Domain Controller Dilemma

Often I have people ask me about the Domain Controller dilemma. The basic problem is this: if you decide to virtualize all of your servers, how do you handle the domain controllers which control the domain used by your Hyper-V servers? There are a couple of options that you can consider here:

 

Keep the root domain controller on physical hardware

By keeping the root domain controller on separate physical hardware you can avoid any potential for problems. However you also miss out on the benefits of virtualization for your domain controller (better hardware utilization, hardware mobility, easier backup, etc...).

 

Keep the Hyper-V servers out of the domain

In small deployments you can consider just leaving the Hyper-V servers as part of a workgroup and then running all domain controllers inside virtual machines. This approach has two problems. First, you lose the security advantages of running in a domain environment and second, it is hard to have multiple administrators in such an environment (as local user accounts need to be created on each Hyper-V server). Also, you cannot use all the functionality of SCVMM in such an environment.

 

Establish a separate (physical) domain for Hyper-V servers

This approach is a compromise between the first two approaches. Here you virtualize your primary domain controller environment, but setup a secondary (smaller) domain environment for your Hyper-V servers using a physical server. The advantage to this approach is that you get all the benefits of having your Hyper-V servers in a domain - but your primary domain environment benefits from being virtualized. The problem with this approach is that you still have an underutilized server sitting around in your server room / data center.

 

Run the domain controller on top of Hyper-V anyway

The last option is to just stick the domain controllers in virtual machines and then join the parent Hyper-V environment to the domain in question. Now, while this sounds like a problematic environment it can be done with some careful planning. Here are the following steps to take / things to consider:

You should configure the domain controller virtual machines to always start when the parent starts - whether they were running before or not (this is configurable in the virtual machine settings).

If you have other virtual machines configured to start automatically you may want to configure them to have a delayed start time (say by a minute or two) to allow the domain controllers to start up quickly.

You should configure the domain controller virtual machines to shutdown (and not save state) if the physical computer is shutdown.

 

I don't know what your budget is like, but an additional server doesn't have to cost a lot. Also, virtualizing everything on a single physical host kind of negates the main advantages of virtualization.

[tmcd35]

Not sure if this has been covered, but is anyone running the Hyper-V role on a 2008r2 domain controller? I was thinking of doing this but someone said it isn't supported by microsoft.

 

We're planning the same thing here. 3 Hyper-V servers running on top of DC's. It might not be ideal but if they are three in sync DC's with GC, DNS and DHCP then the risk of problems if one physical server dies is quiet low.

 

But then again we are planning to use SMB2 folder shares instead of an iSCSI cluster for shared storage. This also is not supported by Microsoft. Oh Hum.

 

Not supported just means that MS will not help you out when it all goes up in flames. It doen't mean that it's not possible or won't work.

[eejit]

Been running all our DCs as Hyper-V virtual machines for over a year now - no probs at all.

[techie08]

Been running all our DCs as Hyper-V virtual machines for over a year now - no probs at all.

 

Thats good to hear. The plan was to reduce the school from two physical servers (DC and SIMS) to one. Making that a brand new 2008R2 Domain controller and then adding the hyper-v role and putting the sims server as a virtual machine. Then this server will have a tape drive (instead one on each physical server at the moment) thus reducing hardware costs even more and reducing costs when purchasing backup exec.

 

Obviously the downside is i would be putting all the eggs in one basket!!!!

[phillock]

Thats good to hear. The plan was to reduce the school from two physical servers (DC and SIMS) to one. Making that a brand new 2008R2 Domain controller and then adding the hyper-v role and putting the sims server as a virtual machine. Then this server will have a tape drive (instead one on each physical server at the moment) thus reducing hardware costs even more and reducing costs when purchasing backup exec.

 

Obviously the downside is i would be putting all the eggs in one basket!!!!

 

I have a mix here with some dc's running on virtual machines (1 hyper-v and 1 vmware) and on 1 site the virtual machines are running on a DC, the only things i reccomend is if you have an 2k3 virtual machines in the boot .ini add the following /usepmtimer this is to stop any timing issues that arise.

Reducing costs with backupexec is intresting concept especially as the virtual agent is not cheap but will backup multiple servers locally as well. - As you are on a dc dont forget to also include the AD client as well for backupexec. good luck

[ahuxham]

Obviously the downside is i would be putting all the eggs in one basket!!!!

 

And Humpty Dumpty has been known to fall off the wall. For the hassle its worth, running a single server for an entire setup is ill-advised, however the choice is yours. Just be prepared to be in school from 8pm till the early morning getting everything backup should anything fail

[PiqueABoo]

the downside is i would be putting all the eggs in one basket!!!!

 

As said above backup is interesting with VMs, and for me that's interesting enough in terms of ££££ to wonder why not just add the SIMS SQL directly to the server, instead of making a VM (which adds £££/overheads/complexity/more things to go wrong)?

[PiqueABoo]

current best practice is to have at least one physical DC that acts as your forest root.

 

On a serious (not a Primary!) failover hyper-v system mine was to make an independent domain for the "virtualisation layer", which has a physical DC+FSMOs, plus another DC in a VM to help cover any outage of the physical DC. With that I'm happy to put the DCs for another domain that does real stuff for the org. entirely in VMs.

 

Unlike the Dilemma quote I don't see any problem with this at all i.e. I'm a **lot** more concerned about stability, security etc. than perfect utilization of every box in the system.

[vikpaw]

As said above backup is interesting with VMs, and for me that's interesting enough in terms of ££££ to wonder why not just add the SIMS SQL directly to the server, instead of making a VM (which adds £££/overheads/complexity/more things to go wrong)?

 

The idea is that having a VM SIMS means if it needs upgrading, restarting etc. it doesn't affect the other VM / host machine. Same principle as any VM, it's isolated.

 

For this small scale example as the OPs, the host machine could just be independent of the domain and run a DC and SIMS server within. If the host fails, then make sure the powers that be understand what is involved in recovery. Assuming the VMs are backed up, you just reinstall Hyper-V elsewhere and attach to the VMs.

 

I was reading the manual for implementation and am still not convinced by Hyper-V. It is available as a standalone install, but that's not recommended if you want to run Win2k8 Server as Guests. So the options are to run it off a main R2 installation or only do a basic core svr install and don't run any services on it. I think i'm right in that...?

 

That's ok in theory, but that means you still have the limitations of running Microsoft software, it will still need patching, updates, and no doubt numerous restarts. Plus it's prone to virii and could be hacked, although the attack surface is much smaller. I just think it's a big single point of failure, if you want/have to restart the core host, all your VMs will need to go down, unless you have a second machine you can live migrate them to whilst you have your downtime.

 

The alternative is to plan your downtime well before hand but that's not always possible. Especially if the system freezes because it's Microsoft. That said, our servers are on the whole fairly stable, but there have still been a few forced restarts over the last 6 months. Enough to be a nuisance.