Adding An Additional Domain Controller To An Existing Domain | Windows Server 2019 

Thanks! I'm glad the video helped. I too have been in those kind of situations!👍

Hi. thanks for your comments and great feedback!! I'm glad you found the video helpful.👍👍

Thank you👍

Many thanks! Great feedback! I'm glad you enjoyed the video👍

Many thanks!

Many thanks!

Great feedback! Thanks 👍

Glad you liked it!

Thanks👍

Thanks Robert! I'm glad you enjoyed the video. Good to hear you are building up your Windows server 2019 skills too!👍 Jon

Thanks👍

Thanks 👍

Hi, good question! That is the approach I prefer to take. Each DC pointing to itself, and the alternative DNS server (another DC as a failover). Glad you enjoyed the video and many thanks for your kind comments 👍

Did you found out why?

@@nicoleanne967 No, I am afraid.

Hi, yes MS DNS is Active Directory integrated.

You just need to transfer the FSMO roles from server 2 to server 1. Then server one will become your Primary DC

Hi, for a server a static IP address is a preferred option. A DHCP assigned the IP address could change if a misconfiguration occurs. The server/s would also be impacted should the DHCP service be unavailable/fail to start etc.

Hi, the second DC will continue to authenticate users in the usual way. It will replicate any changes when the down DC is back on line. It is only necessary to transfer FSMO roles (seize them) should the FSMO role holder fail and be unrecoverable.

Hi, that's correct, but in the case of DNS the IP of the second DNS server will need to be assigned to clients also.

@@ittaster Wonderful! Pls keep making these great videos.

Hi, this is a question that is often subject to discussion. The approach I tend to prefer is to point a DC (with DNS role installed) to itself and other DNS server as a secondary.

Hi, yes provided the forest and domain functional levels support the older domain controller.

@@ittaster Тhank you!

Hi, you may want to consider looking into FSMO roles also, these must be taken into account if a server being removed hosts them.

@@ittaster thank you

Hi, adding a DC to an existing domain provides redundancy. Adding a new domain to an existing forest creates a new child domain, delegating administration and/or following the structure of the organisation.

Hi, after a Windows server is promoted to a DC, it is no longer possible to logon with the local admin account, it only has the domain one. It will be necessary to login with the domain admin account.

Hi, this is an interesting question you ask. For the client workstations, if both DCs are DNS servers you could consider issuing the first DC as the primary DNS server and second DC as the secondary DNS server. But for the DCs themselves there is some debate on this. One method to consider, is to set each DC (with DNS role) to point to itself as primary DNS and the other DNS server as secondary.

@@ittaster Let's say both DC (DNS) servers are on the same network but in two different locations (two buildings joined by a site to site fiber connection). Would it make sense to set clients primary DNS to be the server that's in their building regardless if its the secondary DC?

I agree, DNS is providing resolution to clients and I would suggest that using the local on site DNS server is more efficient, especially in instances where a site to site connection is slower or fails.

Hi, DCs don't have to be the same Windows version. But it's important to check the correct forest and domain functional levels are set to the correct level to support all DCs in the forest and domain/s.

Hi, check out my videos Windows 2019 install and initial config. You will then be able to follow on with adding an additional the domain controller to a domain.

Hi, there should no need to share these folders, this is taken care of automatically when a DC is created/added to a domain. My initial thoughts would be to suggest checking if manual replication is possible with Active Directory Sites & Services. Another suggestion would be to check DNS is resolving both servers (each other) correctly.

@@ittaster So in the primary DC I have a log error The DFS Replication service stopped replication on the folder with the following local path: C:\Windows\SYSVOL\domain. This server has been disconnected from other partners If I go to the secondaryDC there are no shared for the two sysvol folders. I do remember it asking about it during the install as the default directories nad I left as the default. Very strange!

I think this was at one time syncing with the old domain controller from Win SBS 2008. now replication is disabled due to this stale data message. The add replication group wizard looks like a daunting task ______________ The DFS Replication service stopped replication on the folder with the following local path: C:\Windows\SYSVOL\domain. This server has been disconnected from other partners for 793 days, which is longer than the time allowed by the MaxOfflineTimeInDays parameter (60). DFS Replication considers the data in this folder to be stale, and this server will not replicate the folder until this error is corrected. To resume replication of this folder, use the DFS Management snap-in to remove this server from the replication group, and then add it back to the group. This causes the server to perform an initial synchronization task, which replaces the stale data with fresh data from other members of the replication group. Additional Information: Error: 9061 (The replicated folder has been offline for too long.)

If a DC has been offline for a considerable time (60-180) days it's likely to be 'toombstoned'. This will show up in the event logs, dates/times will point to how long there has been an issue. Also worth checking which DC holds the FSMO roles, in the case of an SBS domain, it would normally be the SBS server. However SBS doesn't function quite the same as full blown Windows Server.

Hi, on premises DCs can be integrated with Azure AD, take a look at AD sync for more info.

Hi, apologies for any confusion. This video follows Installing & Configuring Active Directory Domain Services. In the lab I have an existing Windows Server DC (VM). I am working with a second Windows Server (VM) installing ADDS again to create a second DC but, this time joining the domain to create AD redundancy.

Hi yes, you can have a single domain spread over different geographical locations, provided there is a WAN in place for the domain controllers to replicate. Or you can have multiple domains to distribute the administration and management of a large organisation.

@@ittaster does that mean the two DC spread across geographical location is an SAS joint to the same domain? Its the same steps you would take in this video to set that infrastructure up?

@@nicoleanne967 Hi, two or more DCs in the same domain replicate to maintain the Active Directory Database keeping it up to date with changes. DCs don't have to be in the same geographical location. We also have the option to customise the connection topology as to which DCs replicate with each other, and also how often. This can be useful where there are site to site links and speed may be an issue. An option that is also useful for remote sites is a read only DC (RODC). A RODC replicates with other DCs and performs IAM in the same way, but it's read only (eg. does not allow new users to be created etc). Hope this is of help?

@@ittaster Hi Thank you for your reply! This helps a lot thank you 🙏

i have change main DC -Raising domain functional level (2003 to 2008R2), but facing another error Verification of replica failed. The specified domain xxx is still using the File Replication Service (FRS) to replicate the SYSVOL share. FRS is deprecated. The server being promoted does not support FRS and cannot be promoted as a replica into the specified domain. you MUST migrate the specified domain to use DFS Replication using DFSRMIG command before continuing.

Thanks for the suggestion👍

New/additional DCs can be added. DCs can also be removed from a domain (for example following a migration), however it is extremely important to carefully follow the correct procedure and best practices.

@@ittaster can I do it if I have ntfrs service stopped? We have only 1 AD in our small company and out of nowhere that service is not working anymore, I read that is related to file replication

Hi John, I'm good thanks. I hope all is good with you too? You raise a very important point. The directory services restore mode password is different to the regular administrator one. The dsrm password is specific to each DC, and is needed to reboot into dsrm to troubleshoot or restore. Hope this helps. Jon

@@ittaster How are you Jon? Thank you. I don't have so much experience in AD DS but since following you I'm becoming more confident as matter as fact I've been exercising myself adding user and groups. In the other hand I find extremely helpful when you explain AD DS on Windows Server 2008 because even if AD DS have been around before 2008 is a good start. I also like to say that is very important focusing on DNS, DHCP and other important protocols when we talk about replication, besides, I see that you are a good teacher either engineer and next year I'm planning to go to Europe. If you have a school in England I might stopping by and say hello and following some of your teachings. Thank you for your replay. Take care friend. John

Hi, it is necessary to transfer FSMO roles held on the first DC and also take into account any other services, the DC is hosting.

@@ittaster i tranfered the 5 FSMO roles. Now i just shut down the server 1?

Hi, the domain controller must be removed from Active Directory (demoted). Only practice this in your own testing/learning lab. There are Microsoft articles that explain the full process to remove a DC from a domain and the considerations and best practice that should be taken into account. Never carry out the process in a production environment without proper know how and experience, because it can cause serious issues including total loss of Active Directory!

Hi, DNS resilence is an important factor to build into an AD infrastructure design. One method to consider, is for each DC to point to itself for DNS and another DC as a secondary.

@@ittaster got it, makes sense. How about the cluster idea?

DCs replicate changes with each other and are resilient when a DC goes off line. Clustering DCs isn't supported (at least up to Server 2012). AD does the the job already if that makes sense.

i see, makes sense. Thanks for the explanation@@ittaster

Hi, yes, in order to keep up to date with other DCs (DCs replicate by default every 180 mins) and be available in the event of an DC outage.

@@ittaster Okay