Windows Forum

Ask something
Discussion Locked

Force Which DC client uses

0 helpful
9 replies

by tpcosmo

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have 2000 clients that are authenticating to a DC over a WAN, when there is a DC at the same site as the client. I would like to force these clients to authenticate to a specific 2000 DC. I remember seeing an article about a registry setting that will force the client to use a specific server, but now i cant find it anywhere. Does anybody know how to do this, or where I can find an article about this. Thanks a lot.

9 replies

by joseph moore

Do you have the remote office, with the users and their own DC, in their own Site in AD Sites and Services snap-in? If you did, then this should fix this. Machines in their own Site try and authenticate off of their own DC first, then they go out toother locations for authentication. This especially works well if the different Sites are in their own IP segments.
Read TechNet article Q247811 on how DC are located by Windows clients:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q247811
(please remove any spaces)

Hope this helps.

by shanghai sam

I have a remote three seperate offices, each with their own DC. AD Sites&Services is configured with the three seperate Sites. Do I need to add the Users or Computers to the Site?
I have read the article, but it doesnt seem to be true with my situation.
"When a client logs on or joins the network, it must be able to locate a domain controller. The client sends a DNS Lookup query to DNS to find domain controllers, preferably in the client's own subnet. Therefore, clients find a domain controller by querying DNS for a record of the form: ....." But my clients will authenticate with a local server on its subnet, then the next login it will go thru my WAN connection to a remote DC. This seems contrary to what the article says "After the client locates a domain controller, the domain controller entry is cached. If the domain controller is not in the optimal site, the client flushes the cache after fifteen minutes and discards the cache entry. It then attempts to find an optimal domain controller in the same site as the client." I just wonder if I have something configured improperly. Thanks for your help......

by mdavis

One additional note: clients will automatically add themselves to the appropriate subnet in AD Sites and Services, but Domain Controllers only do so on installation of AD. After install, they have to be moved by hand. Not a huge issue, open AD Sites and Services, find your DC, right click and choose move, and specify which site that DC belongs to. Good luck.

by mdavis

What IP address ranges are you using? Same range for all sites? Whose DNS server are you using? Windows 2000 DNS? UNIX DNS? Those could have an effect on which DC your clients are authenticating against.

by joseph moore

I set up a 2 Site AD structure for my office, and for the clients who are located at the remote office, I put their User accounts AND their Computers in the remote Site.
So, I would put all users and computer that are in your remote offices in the remote Sites (and remote OUs).

Also, make sure the Computers are using the DNS servers in the remote sites. That way, the DNS SOA record will point to the remote DCs.

Hope that helps.

by tpcosmo

Thats exactly what I would like to do. But, I dont know how to carry this out. When I go to AD Sites/Services, I dont see any way of adding a computer or User account to a specific site.
In the Users/Comps Snap-in, the Move function only allows moving to other OUs within Users/Comps. Thanks a lot for the tips.....

This discussion is closed to new replies.