Windows Forum

Ask something
Discussion Locked

BDC's not Auth'ing Users After PDC Fails

0 helpful
7 replies

by netgeorge

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Environment: PDC is NT 4.0 / BDC's are Win 2000
- PDC has not yet been upgraded to 2000 due to political reasons
Issue:
.When the PDC has gone down the entire network is unable to Authenticate via 2000 Login
.There are several BDC's in the Domain
.I am curious of a reason for this failure OR if it's doing this since there are no global Catalogs avail. on any of the BDC's.
.since the site has not fully implemented a 2000 AD enviroment is this an issue that will cease at the time the PDC isupgraded and AD is avail fully
OR is issue fixable in it's current state?

7 replies

by timwalsh

The reason for this failure is because you don't really have any BDCs.

Rules for Win2K and Active Directory:
1. To make a Domain Controller (DC) from a Win2K Server, you MUST install Active Directory.
2. Win2K DCs CANNOT exist in an NT4 domain (because NT4 doesn't understand Active Directory).
3. To upgrade (migrate) an NT4 domain to a Win2K domain, Win2K (and Active Directory) MUST be installed on the NT4 PDC.
4. NT4 BDCs can exist in a Win2K mixed-mode domain.

These rules are inviolate. Doing anything else will leave you with an unusable AD environment.

BTW, in AD, the PDC/BDC relationship you are familiar with no longer exists. All DCs are essentially equal.

If your PDC is unrecoverable, your domain is unfortunately lost if you don't have a good backup from your PDC. You won't be able to get anything out of your Win2K ersatz BDCs

by sfix

If I were you and the PDC was still available I would get an NT 4.0 BDC built FAST! Using whatever spare machine was free. Don't forget, if you go with all Win2k Domain Controllers your client MUST ALL be Windows 2000. If you still have some NT or 98 clients you're going to need to keep an NT 4 BDC and run your 2k domain in mixed mode.

by lordinfidel

Just adding to poster #1's comments..... He is correct with the fact that you have no bdc's.

With regards to 2K dc's, they are essentially equal, excpect for the 1st one you install, it is basically the father of all the rest.

All other DC's you install that you want to authenticate, have to be specified as a Global Catalog Server. I have no idea why MS set it up this way, it is only a check box in AD Sites/Services that enables a DC as a GC.

No points needed... this was just a sidebar.

This discussion is closed to new replies.