Two campus sync'd AD servers

[Niall]

Hi guys, I am setting up a new network over the summer in our school. We have two buildings, about a half mile apart. They are connected by a 100mbs radio link on the roof. It is pretty stable but occasionally someone puts a tower crane or something in the way and we lose it for a few days.

 

I want to have a server in each building that runs the AD and has the user shares on them. I want people in building A to use server as their gateway/dns/ad server etc and when they go to building B, use server B etc.

 

Of course I need all the info in the AD and on the shares to be in sync. Is it possible to set something up that will sync the AD, GPO etc data every night and also sync any changes in shared data? This way if we lose the link people can still operate relatively normally.

 

Failover clustering doesnt seem to be what I need. Obviously we can't have a physical cable link between them or we wouldn't need this solution.

 

Summary:

• Two servers, one LAN, physically separated with 100mbs radio link
  
• Need both servers to be AD servers and store the shares
  
• Need both server to be reasonably in sync (1/2 days old) for shares and up to date for AD, GPO info etc.
  
• Currently running one server for the whole place, what's the best way to set up the second?
  

 

 

Thanks in advance,

 

Niall.

[soveryapt]

Your best bet is to make use of DFS (Distributed File System) that's built in. This would take care of your shares etc (you can either set it to do it immediately or to update at specific times).

 

If you join both the servers to the same domain having one as the PDC and the other as a member server then they will both look after the user authentication and the sharing of GPO data etc.

 

The only other thing to do then is to make sure that you have a DHCP server set up on each site which will handle the gateway information. Depending on how many computers / IP ranges you are using (or have assigned to you) you might want to split the scope so that the sites don't hand out the same IP addresses as when your radio link is working, you'll find that one server may take precidence over another for DHCP, but when the radio link get's blocked for whatever reason, you will have a DHCP server on that site to handle the failover stuff too.

 

That's the way I'd be looking to do it anyway .. hope that helps a bit ..

Andy

[jamesfed]

You should have a look at something called Distributed file system in the Enterprise (and heigher) versions of Server 2008 R2.

AD and GPOs should sync anyway reguardless of the edition of Windows Server you have but using DFS would allow you to sync your shared documents between the sites.

 

One place to start learning more- DFS Step-by-Step Guide for Windows Server 2008

[pantscat]

If you've got the potential for periods of non-communication between the sites, I'd probably make one of the DCs read-only.

[Domino]

Your best bet is to make use of DFS (Distributed File System) that's built in. This would take care of your shares etc (you can either set it to do it immediately or to update at specific times).

 

If you join both the servers to the same domain having one as the PDC and the other as a member server then they will both look after the user authentication and the sharing of GPO data etc.

 

The only other thing to do then is to make sure that you have a DHCP server set up on each site which will handle the gateway information. Depending on how many computers / IP ranges you are using (or have assigned to you) you might want to split the scope so that the sites don't hand out the same IP addresses as when your radio link is working, you'll find that one server may take precidence over another for DHCP, but when the radio link get's blocked for whatever reason, you will have a DHCP server on that site to handle the failover stuff too.

 

That's the way I'd be looking to do it anyway .. hope that helps a bit ..

Andy

 

This, with a small change.

 

I'd set the sites up as two distinct sites in AD sites and services - then you can be assured that authentication will happen to the closest DC based on the IP information. reducing the potential bandwidth across the link.

 

Also DFS-R is what you're looking for rather than DFS. and it's included in standard server, doesn't require enterprise.

 

If your domain functional level can be set to 2008 you can take advantage of a much improved DFS version than the old 2003 version - should be a performance improver.

[soveryapt]

This, with a small change.

 

I'd set the sites up as two distinct sites in AD sites and services - then you can be assured that authentication will happen to the closest DC based on the IP information. reducing the potential bandwidth across the link.

 

Good point .. I'd of probably come to that eventually if doing it myself .. lol ..

[Niall]

Thank's for all the information. We are running 2008R2 Enterprise so I'll give DFS a try. Setting up the second server now. I'll set it up as a distinct site in AD.

This is also a completely new install, new servers and new Workstations so I'll make sure they are set to 2008 functional level.

 

I will keep you posted.

 

Niall.

[Niall]

Ok round one complete. Second server is up and running, have it under a second site with it's own dhcp scope. All seems happy so far. I played with dfs a little bit but that is tomorrow's task, thanks for the stepy by step James, very helpful.

 

As an aside, does any have a script (powershell, vba, vbs or otherwise) that will read all the users from an ou and create shares with each user having read/write? I'm just looking for an automated way to crate personal drivers for file storage & folder redirection. I have a very nice vba script that I can use from within excel to create users and put them in ou's but I don't have an automatic way to create home shares for each user.

[soveryapt]

As an aside, does any have a script (powershell, vba, vbs or otherwise) that will read all the users from an ou and create shares with each user having read/write? I'm just looking for an automated way to crate personal drivers for file storage & folder redirection. I have a very nice vba script that I can use from within excel to create users and put them in ou's but I don't have an automatic way to create home shares for each user.

 

Are you wanting to create shared areas or just areas for each users documents etc?

 

If the latter, then make use of the folder redirection for the users in the GPO and just tell it where the base share is to be (\\your.domain\DFS-Share\) and then it will create (so long as you choose the right setting) a sub folder for the user under that. I have a number of these set up - Staff, Students, Admin, Year Group, etc - so they are all stored in a slightly different folder (\\domain\staff, \\domain\students, etc) which means I can find people easily enough.

 

It's fairly easy to do the whole shared folder for other access to, but I can't remember how I have it set up / which scripts I use etc, but I'll take a look tomorrow if no one else answers in the meantime ..

[Niall]

Apt, that is absolutely amazing! I have never heard of that feature before. I just got it working now, as well as DFS shares. The other shared drives should be fine, I can just create a few and add the security groups to it. Thanks again!

[soveryapt]

No worries ..

[Niall]

Ok another round of questions on this topic:

I have two sites set up, two servers, one in each site. The AD replication is working.

I want both servers to hand out DHCP for their respective sites.

All workstations are dynamic DHCP.

They seem to be randomly choosing a server.

How do I assign a client/workstation to a site? I know I have to use subnets, and I have defined subnets for each site. But the site property for every computer is blank.

[Domino]

Crack open Active Directory sites and services, and setup a site for each physical location.

 

Best practices here Best practices for Active Directory Sites and Services

[Niall]

Hi Domino,

 

Nice link. I have a site for each physical location, a domain controller in each, global catalog on both. They have a subnet each and replication is running every 15 minutes.

How do I align workstations with a site? I have a bunch of computers in diffrent OU's depending on where they are in the building but I don't know how to tell them that DC X is the one they should look at for their AD needs.

In the computer properties there is a site field but it is blank for all our computers.

 

Cheers,

 

Niall.

[ChrisH]

Computers know what site they are in because of the sites associated subnet.

[Niall]

The entire LAN runs on the same subnet, they are in two locations but connected by a 100mbs radio link. Every computer is on the same subnet so there is no way to have them automatically join a site. Unless I am just being very thick about this.

[ChrisH]

You can only add DCs to a site the rest as I say is done through the associated subnets therefore it won't work unless you have different subnets.

For a client, site assignment is determined dynamically by its IP address and subnet mask during logon.

Source

[Niall]

Thanks Chris, so I have to use static ip addresses for each workstation? Is there any way I can prioritise one server over the other for dhcp?

[ChrisH]

You need a router or layer 3 switch. One DHCP server can handle multiple scopes for all subnets. If you have a DHCP server on one subnet ie one on each site it will only find the server in that site as it uses broadcasts to get an address and that will not go over your router/switch unless you configure IP helpers or a DHCP relay. Either way you do it your going to need a router. You could use one of the Windows server roles as a router if you want but more than likely a hardware or some kind of Linux distro on an old box would be better. Edited July 11, 2011 by ChrisH

[Niall]

Ok that makes sense, I have a bunch of cisco switches that I'll need to start digging around inside. They were here previously and probably doing dhcp relay already.

 

Thanks Chris!

[Timetable]

Hi Niall,

 

I feel your pain as you are doing exactly what we are, i posted a different thread but going to hijack this with you if you dont mind...

 

ChrisH - we have been tod two subnets and have a cisco router between our two sites to deal with the two subnets.

 

What i would like to know is how to setup the other subnet... and what to choose....

 

We have 192.168.8-15 subnet mask 255.255.248.0 on our main site. what would you recommend for the second subnet on the other site? we thought 192.168.16-20 and same subnetmask...

 

i imagine i am totally wrong like... lol

[Niall]

Hi Timetable,

 

I am avoiding all the subnetting and static IP stuff by using vlan's on the cisco routers. This is a very easy way to segregate anything you like. We have cisco catalyst routers, all of which have a nice little software interface and can also be managed by the free to download Cisco Network Assistant.

In a nutshell, you can assign a vlan number to every single port of a switch (or multiple switches) and only ports that are in the same vlan are visible to each other.

For example, port 1 to 10 on a 24 port switch could be in vlan 1 and port 11 to 24 in vlan and 2. You could have two dhcp servers running on the same infrastructure and not have them interfere with each other once they are on separate vlans.

You can also have one port on 2 vlans using tunneling... but that's a work in progress and I'll let you know how I get on

 

Niall.