2 DC's - one getting hammered, one almost idle - why?

[sidewinder]

Ive got 2 domain controllers, both are DNS servers, both are DHCP servers.

DHCP on each server gives out addresses with itself as the primary DNS, so DNS should be roughly load balanced.

 

But for logins etc, the second DC doesnt seem to get touched, CPU is always at under 10%, while the other one is normally 30 - 60%.

Nothing different running between the machines, mostly same processes

 

The first DC is the user documents server, which obviously contributes a fair bit, but the other one holds all the common area so there should be some load on that too.

 

It just seems everything uses the first DC for logons, which slows things down greatly.

 

I always thought now there are no PDC's and BDC's like there used to be and all DC's are equal, they should take some of the load each...obviously not

 

Never really had to think about it before, but more and more additions to the network of course mean more traffic

[Chafftech]

The logons probably are baing load balanced between the DC's (have you made sure they see each other as secondary DNS server?)

 

If you run all the user profiles from one server then it will get hammered more than the other (especially if they are roaming profiles).

[Geoff]

It might be a network problem. Whats the connectivity like? Anything out of the ordinary setup? Wifi bridges? VLANs? firewalls? routers?

[djm968]

Are both DC's configured as Global Catalogs? The Global Catalog holds data that permits network logon.

[sidewinder]

Chafftech do you mean locally on the servers? No they only have themselves as their DNS servers

And yes, profiles are all on that first server, however only 6th formers and staff have roaming profiles, the rest of the students are on mandatory, yet big classes are still taking ages to log on sometimes

 

Geoff - Nothing out of the ordinary, no. No VLANs, all one subnet. Servers have gig links, each department has a gig link or 2 to their switches

 

djm - yes both are GC's, although after reading on here about that last week they both may not be for much longer

[Geoff]

If you run DCDiag on both DC's do you get any warnings or errors?

[djm968]

Sidewinder: to be honest I think this is to be expected, especially considering the server also acts as the main file server.

 

One relatively cheap option to increase network throughput would be to install a dual port GB nic and team the adapters.

[Geoff]

One relatively cheap option to increase network throughput would be to install a dual port GB nic and team the adapters.

 

I thought the problem was CPU usage not network throughput?

 

How about a CPU upgrade? Is there a spare socket in the motherboard to go dual processor perhaps?

 

The other thing would be to move the fileserving to another dedicated server specifically for that purpose.

[eejit]

Are both DC's configured as Global Catalogs? The Global Catalog holds data that permits network logon.

 

I don't know where that myth came from, but it seems impossible to kill.

[djm968]

Microsoft myth maybe?

 

http://technet2.microsoft.com/WindowsServer/en/library/24311c41-d2a1-4e72-a54f-150483fa885a1033.mspx?mfr=true

[Geoff]

Only applies to forests with more than one domain though.

[djm968]

Although it is true that the logon process does not require a GC, when a new user account attempts to log on, the GC is queried and authentication will fail unless cached credentials exit on the local computer. Exchange also uses the GC extensively.

 

http://support.microsoft.com/default.aspx?scid=kb;en-us;216970

[eejit]

Yes, in one domain in one location - you only have one Global Catalogue, but the other thing is about logging on. You don't need a GC available to log on.

[Chafftech]

Chafftech do you mean locally on the servers? No they only have themselves as their DNS servers

And yes, profiles are all on that first server, however only 6th formers and staff have roaming profiles, the rest of the students are on mandatory, yet big classes are still taking ages to log on sometimes

 

 

Yes I do mean locally on the servers. To aid balancing they should both see each other as secondary DNS. But I don't think this will make a massive difference to the problem you are experiencing (although something is better than nothing).

 

It probably is a cpu / memory / hard disk bottleneck if you are sure that it is not network bandwidth related.

 

How many user profiles do you have on that server

1)in total

2)logon at the same time

[Geoff]

Also what sort of size profiles are we talking about?

[Guest Guest]

I had a very similar one a while ago. Ended up being the profiles, and ours are also manditory but for everyone inc staff.

 

What spec DC are we talking? I found the bottle neck was the HD read speed so moved the profiles over to the app server which has SCSI RAID5.

 

You could also copy the profiles to the other server and have them both dishing out profiles. Just change the profile path in AD to %logonserver%\profile

 

We had ours like the above on 2 DCs running RAID10 but when i moved the profiles to a single SCSI RAID5 server the logon times decreased drematically.

 

Just remember that accessing lots of little files is far more intensive than accessing few large files. Therefore making sure any unused files in the profiles are deleted could be a big step forward - things like startmenu item's if you run them from your DC.

[sidewinder]

I thought the problem was CPU usage not network throughput?

 

How about a CPU upgrade? Is there a spare socket in the motherboard to go dual processor perhaps?

 

The other thing would be to move the fileserving to another dedicated server specifically for that purpose.

 

There may well be a spare socket, but the server is getting replaced by 2 new ones in a few months, but of course staff want improvements *now*

 

May well consider moving some of the file serving tasks

 

As for DCDiag, havent got it installed on the 2nd server, have to find the cd, but no errors or warnings running it on the 1st one (the problem one)

 

 

It probably is a cpu / memory / hard disk bottleneck if you are sure that it is not network bandwidth related.

 

How many user profiles do you have on that server

1)in total

2)logon at the same time

 

Probably around 300-400 roaming profiles, which covers all staff and 6th form. Everyone else just uses one mandatory student profile (should I have one for each year?)

 

Logging on at the same time, unsure, possibly about 200 if you count all the main computer suites logging on at start of lessons

 

Also what sort of size profiles are we talking about?

 

Mandatory profile is only just over 1mb

Roaming, there are a few large ones but mostly around 10-30mb

 

What spec DC are we talking? I found the bottle neck was the HD read speed so moved the profiles over to the app server which has SCSI RAID5.

 

You could also copy the profiles to the other server and have them both dishing out profiles. Just change the profile path in AD to %logonserver%\profile

 

We had ours like the above on 2 DCs running RAID10 but when i moved the profiles to a single SCSI RAID5 server the logon times decreased drematically.

 

The DC is over 2 years old, single 2.4Ghz Xeon with 1GB RAM but with a RAID5 array with 10,000RPM drives, so although it does need upgrading, its not awful

 

I didnt know you could do that with profiles, that looks like it could be brilliant. Will try that on some accounts today.

 

Also you mention start menus, ours is massive, probably about 200+ items, but is it possible to mirror that too and redirect it to whatever logon server has been used? We use a basic redirected folder in group policy, one for each type of user: staff, pupils, admin etc

[Geoff]

Also you mention start menus, ours is massive, probably about 200+ items, but is it possible to mirror that too and redirect it to whatever logon server has been used? We use a basic redirected folder in group policy, one for each type of user: staff, pupils, admin etc

 

You can't use the '%logonserver%' variable in the folder redirection settings. The easiest way to get around this is to use a DFS share.

[ChrisH]

I put my start menus in the netlogon share and then just define \\domain\netlogon as the path in GP. That way they are replicated and spread around.