Adding second domain controller

[reggiep]

Hi All,

We set up our new server 2008 R2 domain over summer and now have a second server that we can add as DC2.

We have installed Server 2008 R2 on it and are about to DCPROMO it.

Are there any extra settings I should be aware of before we go ahead and do this?

This is not the sort of thing we do every day!!

 

Thanks

[themightymrp]

Making the server into a DC will likely install DNS services, you may want to add that second servers IP as a secondary DNS server in your DHCP settings? Just for load sharing etc

 

Other than that it should be fairly straight forward

[sonofsanta]

Should be fairly easy - it leads you through it in the dcpromo anyway. If you're just putting your second DC in you might want to consider splitting your DHCP scopes between the two servers - set the entire scope up on each, then disable half the range on each one, so that if a server ever goes down you can just remove the restriction and your full DHCP scope is serviceable still. Fairly brute-force load balancing, but fairly common as well.

[Duke5A]

Should be fairly easy - it leads you through it in the dcpromo anyway. If you're just putting your second DC in you might want to consider splitting your DHCP scopes between the two servers - set the entire scope up on each, then disable half the range on each one, so that if a server ever goes down you can just remove the restriction and your full DHCP scope is serviceable still. Fairly brute-force load balancing, but fairly common as well.

 

Only thing you have to watch out for when splitting a DHCP scope between two servers is to make sure the subnet has twice as many addresses available as the total number of clients in it. If one of your domain controllers does stop functioning you could run out of addresses in the scope on the backup.

 

Make sure the new DC is a global catalog server too so it can process login requests.

[reggiep]

Make sure the new DC is a global catalog server too so it can process login requests.

 

I'll take note of that.

 

Thanks.

[ADMaster]

also consider balancing out your FSMO roles, if you only have one DC now, it will hold all of them. Consider transferring some of them to the new DC.

[reggiep]

Last time we moved fsmo roles between DCs we couldn't move them back to demote one of them! We had to live with a slightly faulty domain DC for a year as we couldn't demote it!

[oxide54]

Last time we moved fsmo roles between DCs we couldn't move them back to demote one of them! We had to live with a slightly faulty domain DC for a year as we couldn't demote it!

 

 

if there were no roles on it, you could have just turned it off reinstalled over the top and used ntdsutil to remove any reference of it from the domain

[glennda]

also consider balancing out your FSMO roles, if you only have one DC now, it will hold all of them. Consider transferring some of them to the new DC.

 

In small environments i prefer to have them in one place. You can always steal the roles in it fails.

 

I've also read somewhere you shouldn't run DHCP from a DC for security purposes but can't remember why.

[rslulz]

If you can stand his voice here is a video. Dcpromo does most of work for you...

[oxide54]

In small environments i prefer to have them in one place. You can always steal the roles in it fails.

 

I've also read somewhere you shouldn't run DHCP from a DC for security purposes but can't remember why.

]

 

i think its because the account that the DHCP service runs as has more access on a DC than on a Member Server.

[rslulz]

]

 

i think its because the account that the DHCP service runs as has more access on a DC than on a Member Server.

 

It's better to have the firewall handle dhcp if in te event the dc gets compromised you can still kick sessions and isolate it for damage control.

[oxide54]

It's better to have the firewall handle dhcp if in te event the dc gets compromised you can still kick sessions and isolate it for damage control.

 

 

no idea what your on about tbh, buti don't think about it being a security risk myself, i was just offering reasoning to what glennda had read.