0

I inherited a Windows 2003 R2 Domain Controller and to ensure I have resiliency, I added a second DC as Additional DC with DNS.

Now I shutdown the Primary DC but for unknown reasons, the FSMO roles where not transferred to the 2nd DC hence failing authentication but I know with Windows 2008 DCs, the roles are transferred automatically.

Do I have to manually move the roles to the 2nd DC for Windows 2003 DC setup?

Thanks

1 Answer 1

0
  1. Shutting down a DC doesn't transfer the FSMO roles. Running DCPROMO on the old DC to demote it will transfer the FSMO roles to the new DC.

  2. You can use dcdiag to check the FSMO roles as well as DNS (and many other aspects of AD).

  3. It sounds like you haven't configured the new DC as a DNS server for your AD clients (including the DC itself). In order for an AD client (including the DC) to find a DC it has to be able to query a DNS server that hosts the AD DNS zone. If one DC/DNS is down and the clients (including the DC) aren't configured to use the second DC for DNS than they'll never find the new DC.

2
  • I am fully aware of this and the client machines are already setup to point to the 2nd DC as alternative DNS. For some reasons, when the root DC goes down, the 2nd DC fails FSMO roles Mar 30, 2014 at 16:16
  • 1. What do you mean when the root DC goes down, the 2nd DC fails FSMO roles? What exactly is failing? 2. The FSMO Role holder being down will cause the second DC to fail FSMO related tests such as the KnowsOfRoleHolders test in dcdiag but that would be expected. This shouldn't cause any immediate problems, unless you're trying to extend the schema, create an additional domain, etc. 3. The FSMO role holder being down shouldn't be causing any problems for your AD clients.
    – joeqwerty
    Mar 30, 2014 at 16:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .