Windows Forum

Ask something
Discussion Locked

Install order: RAS or dcpromo first?

0 helpful
7 replies

by na_paul

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a Windows 2000 domain (single server, domain, tree & forest)to which I am going to add a server for RAS (remote access). Does anyone have any recommendations on which to do first: run dcpromo to make this server my second domain controller, or install RRAS?
Does it matter or is it better to do one before the other?

7 replies

by swilliam

while you do need a second dc for fault tolerance, i would not install rras on a dc. install rras on a separate server so you can apply unique security policies to it and not compromise the domain. you should protect your dc's from any type of remote direct access (other than terminal services in remote admin mode, of course).

by na_paul

The intended use for the RAS server is for dial-in remote access at least at thos time. I feel the need for a backup DC outweighs the security risk. My question was intended to find out if there is a technical/configuration need to install either serice first (DC or RAS). From the answer I could infer that I can go ahead and install RAS then when I have that up and running make the server a domain controller.

by russell gates

Install DC-Promo first. Look into VPN as an alternative to RAS. Since it sounds like all your machines are W2000? Native mode is the way to go. Enable kerberos security with the highest encryption (128 bit) and certificate services for authentication. You can use these built-in tools to help protect your sys from perps. It is always good to have a backup DC.

by na_paul

Is there a reason to install DC first? The main purpose of my question was to find this out. Otherwise I would probably wait until I have the RAS all configured and running before making it a domain controller.
The initial use of the RAS server will be for dial-in access. Yes, all of our users computers on the network are W2k pro, but we may need to provide remote access to other OS's(w98 &/or ME).
Try again.

by russell gates

After reading your answer I can see your question more clearly. I believe you are on the right track. The ras could be upgraded to DC-backup. DC promo would just make your pre-existing member server a backup DC. I know I don't need to say this but,please backup the ras. You mentioned ME as another os. I was told that ME does not work inside W2K. Is this correct?

by na_paul

I thought I had already submitted this response once, but it apparently did not register. We do not have ME in house, I was speculating on possible user dialing in from home, but I do not know if that will really work or not.

This discussion is closed to new replies.