Off line DC.

  • Thread starter Thread starter JRS
  • Start date Start date
J

JRS

Hi All,

I need to stand up a domain that will have two sites. The problem is I
need to do this before the WAN link is up. How long can the remote
site's DC work without updating with the main site? I seem to
remember there is some kind of time limit a DC can be removed from the
operation masters. Due to the type of AD domain/network (classified) I
can not even have it go through a modem to update the DC's.

Thanks
Jon
 
A DC should not be cut off from the rest of the network during the tombstone
period (180 days for Windows 2003 SP1, 60 days for Windows 2000 and Windows
2003 gold). In addition, there are several reasons why such a plan is
problematic and best avoided if at all possible. The FSMO roles will be
inaccessible between the disconnected sites for one thing, and if you are a
security conscious site then any account disabling or locking out at one
site will not take effect at the other site.
AD was not designed for such a deployment scenario and you should try to
avoid it if you can.
 
Simon Geary said:
A DC should not be cut off from the rest of the network during the tombstone
period (180 days for Windows 2003 SP1, 60 days for Windows 2000 and Windows
2003 gold). In addition, there are several reasons why such a plan is
problematic and best avoided if at all possible. The FSMO roles will be
inaccessible between the disconnected sites for one thing, and if you are a
security conscious site then any account disabling or locking out at one
site will not take effect at the other site.
AD was not designed for such a deployment scenario and you should try to
avoid it if you can.
Click to expand...

Everything Simon said, and...

Don't even get CLOSE to "tombstone lifetime" since it is a
hard interval.

You will lose cross subnet browsing if the "site" without
the PDC Emulator has more than one subnet (or more than
one domain but this doesn't sound like your case.)

You may have trouble replicating when you do hook up
due to time drift unless you independently set the time on
the DCs (not hard to do, but easy to overlook -- limit is
5 minutes difference which is usually maintained automatically.)

You should probably consider at least a weekly dial up.

You can even set the replication interval so the two DCs (sets of
DC) will not consider that abnormal.)
 
Thanks for all your insight.
I did not think I could do it, but I did not have the info to go to
management and tell them it's not going to work.
Thanks again.
 
JRS said:
Thanks for all your insight.
I did not think I could do it, but I did not have the info to go to
management and tell them it's not going to work.
Click to expand...

Well, you 'can' do it for a while OR (better) if you let them
talk once or twice a week.

Unless the AD changes are very large, then you can do that
occasional contact over a dial up line. Even adding 100
users is likely around 400 KB.

Dial modems can handle that if the line is reasonably clean
and you work to make sure the line is up when the DCs try
to talk -- also this is one of the cases where the "mutual
replication" (registry) flag is useful.

Normally replication is one way (performed by each side
separately) but with the mutual flag set, then when one calls
the other DC they both get their changes.
 
Back
Top