Networks

Ask something
Question Locked

Setup a Multi-site Domain

0 helpful
7 replies

by levi_l

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am providing support for a company that has 6 sites across town. I want to implement a Active Directory Domain across the sites so people can move from site to site without problems and it will make managing the 400 employees much easier. All of the locations are connected via a fiber 3.0Mbps Vlan, but are on seperate subnets: 172.27.x.x, 172.28.x.x, 172.29.x.x, etc.

My questions are:
1) does there need to be a DC at each location?
2) Should I setup sub-domains for each location like: location.maindomain.com, or should I just have one domain without the subnets?
3)If I do have a DC at each location, can those DC also serve as a BDC for the other 5 locations, or would I have to have a Main DC and a Backup DC at each location?

I'm thinking that I could just have a linux box or the router do DHCP at the other locations, and just point DNS to the main and backup DCs on another subnet. I just don't know how much of a problem it will be.

I am also considering using roaming profiles. I have some questions about that as well.
1) what will roam with the profile? (printers, documents, outlook pst's, etc)
2) If I can just use one main DC and one backup DC, will this cause huge network latency issues?

I really appreciate any input that you may have. I'm kinda getting in a little over my head, but I'm sure I can do it, if I can get some good feedback from you all.

Thanks again for your help!

7 replies

by levi_l

I will be using MS AD. Although drupal is a useful tool, AD will be our main avenue.

Thanks for the info though.

by ic-it

Basically a Site is a location. Establishing an AD Site allows quicker responses to DC type requests i.e. authentications, logons, etc.
Here is a basic document that explains a Site nicely;

http://filedb.experts-exchange.com/incoming/2008/08_w35/53729/Active-Directory-Sites-and-Servi.doc

Here is an answer BFilmFan gave to a similiar question involving two buildings and two subnets (each site must have a subnet).

You should create an Active Directory site for building 2 and associate it with the subnet 10.1.0.0. Clients locate domain controller based upon their site information.

There is a fairly thorough explanation on Microsoft's site here:

http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/deployguide/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/all/deployguide/en-us/dssbd_topo_vhqq.asp

Job Aids for Windows 2003 has a worksheet that will probably impress the management folks:
http://www.microsoft.com/downloads/details.aspx?FamilyID=edabb894-4290-406c-87d1-607a58fc81f0&DisplayLang=en

And an example of planning domain controller placement can be found here:
http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/deployguide/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/all/deployguide/en-us/dssbd_topo_tsmm.asp

Best of luck with your project.
Posted: 12/30/2004 @ 04:23 AM (PST)
BFilmFan

by cg it

MS Active Directory best practice for DCs at sites is if there are few users and no servers, and reliable fast WAN link, you don't need a DC.

Subdomains [child domains] are only needed if you want to have different password policies for each site. [password policies are domain wide]

If you have DCs at sites, they can act as domain controllers for other sites because DCs in a domain are peers with each other [regardless of location]. Again best practice is the reliability and bandwidth on the WAN link because users who can not find the local DC will go over the WAN link to find it.

Roaming profiles will chew up network bandwidth because no matter where the user goes, the profile needs to load. you'll have to experiment with your network to see if roaming causes network slowdown.

One DC and one backup DC for 400 users, all who probably will want to log in at the same time each morning might cause you some network slow down. Especially if a portion of those users are at sites without DCs and must query a remote DC. See the Active Directory best practices outlined above.

by levi_l

So if I do create a Subdomain (i.e east.main.com and west.main.com) the DC at the east location and function as a BDC for the west location, in the event of server failure?

Or when you stated that they can all work together, that was only if they were on the same domain.

At the moment I have 2 servers, one with server 03 and one with 08. I started setting up one of them at a location, and stopped, because I didn't want that server to be the Main DC (which I guess doesn't really matter because it will be the main DC for that site).
I guess what I am going to do is delete that Domain, and start from scratch. I'm going to just setup one domain (i.e main.com) and they all will be on the same one.

One other question I have is this:
does it matter what I put after the domain name? (i.e - main.com or main.local)

My first dabble in Domains, a guy came a setup a SBS 2003 Server and we setup a domain. He called it businessname.local instead of .com
Does it matter which you put? Will it integrate better with a web server if you put .com?

Thanks for your help, it's very much appreciated.

by cg it

Active Directory. All domain controllers are peers. PDC & BDC are from the days of Windows NT.

MS Best Practice for child domains is:
If you need different password policies for different sites, use child domains for the sites. Password policies are applied domain wide. Keep it simple, don't go further than 4 levels on namespace. Same with OU structure [though typically OU structure follows functional organizational structure.

As far as what extension to use, MS Best Practice recommends using a non FQDN extension. For SBS, this is the default and is so that non resolved DNS queries are forwarded properly and security [typically small businesses DNS servers are not authoritative DNS servers for the domain name. ].

As far as Domain DNS servers handling queries for root and child domains, if you use Active Directory intergrated DNS updates, any DC should be able to resolve DNS queries for Active Directory resources [eg global catalog,infrastructure master etc. {FSMO roles}]

If you are unfamiliar with Microsoft Active Directory, suggest you study up on Active Directory design.

This discussion is closed to new replies.