aééäçóáåö=táåççïë= péêîéê=ommp=oéöáçå~ä= açã~áåë

Transcription

1 C H A P T E R 7 aééäçóáåö=táåççïë= péêîéê=ommp=oéöáçå~ä= açã~áåë Deploying Microsoft Windows Server 2003 s involves creating new geographically based child domains nder the forest root domain. Deploying new Windows Server 2003 s allows yo to create a new domain strctre or improve yor existing domain strctre to take advantage of available bandwidth and optimize replication traffic. In This Chapter Overview of Deploying Regional Domains Reviewing the Regional Domain Design Delegating the DNS Domain for the New Regional Domain Deploying the First Domain Controller in a New Regional Domain Deploying Additional Domain Controllers in a New Regional Domain Reconfigring the DNS Service Configring Operations Master Roles Additional Resorces Related Information For more information abot the Active Directory directory service logical strctre, see Designing the Active Directory Logical Strctre in this book. For more information abot Active Directory site topology, see Designing the Site Topology in this book. For more information abot hardware reqirements for domain controllers, see Planning Domain Controller Capacity in this book. For more information abot deploying the forest root domain, see Deploying the Windows Server 2003 Forest Root Domain in this book.

2 260 Chapter 7 Deploying Windows Server 2003 Regional Domains Overview of Deploying Regional Domains After yo complete the deployment of the forest root domain, yo are ready to deploy any new Windows Server 2003 s specified by yor design. Windows Server 2003 s inclde domain controllers that are rnning the Microsoft Windows Server 2003, Standard Edition; Windows Server 2003, Enterprise Edition; or Windows Server 2003, Datacenter Edition operating systems. The design team determines which s to deploy. As an alternative or in addition to creating a new, yor Active Directory design might reqire pgrading existing domains. For more information abot performing an in-place pgrade of a Microsoft Windows NT 4.0 accont domain to a, see Upgrading Windows NT 4.0 Domains to Windows Server 2003 Active Directory in this book. For information abot performing an in-place pgrade of a Microsoft Windows 2000 domain to a, see Upgrading Windows 2000 Domains to Windows Server 2003 Domains in this book. Note Yo can simltaneosly create mltiple s and perform inplace pgrades of mltiple Windows NT 4.0 or Windows 2000 domains. Yo do not need to complete the deployment of one before proceeding to the next. After yo deploy a new, yo can create an organizational nit (OU) strctre and either add new sers, grops, and resorces to the domain, or se the domain as a target for restrctring existing Windows NT 4.0 or Windows 2000 domains.

3 Overview of Deploying Regional Domains 261 Process for Deploying Regional Domains Deploying s involves completing the tasks that are shown in Figre 7.1. Figre 7.1 Deploying Regional Domains Review the regional domain design Delegate the DNS domain for the new Deploy the first domain controller in a new Deploy additional domain controllers in a new Reconfigre the DNS service Configre operations master roles

4 262 Chapter 7 Deploying Windows Server 2003 Regional Domains Backgrond Information for Deploying Regional Domains Before yo deploy s, become familiar with how yo can save time dring the deployment process by atomating installations and sing the Active Directory Installation Wizard. Atomating Installations Yo can perform an nattended installation of Active Directory by spplying an answer file when yo rn the Active Directory Installation Wizard. For more information abot sing an answer file to install Active Directory, in Help and Spport Center for Windows Server 2003, click Tools, and click Windows Spport Tools. Search for Ref.chm in the Deploy.cab file for examples and instrctions abot creating an answer file. Yo can atomate the installation of Windows Server 2003 by sing Sysprep.exe or an nattended installation. For more information abot atomating installations, see Atomating and Cstomizing Installations in this kit. Using the Active Directory Installation Wizard Windows Server 2003 incldes improvements to the Active Directory Installation Wizard. When yo install the first domain controller in a domain, yo can allow the wizard to atomatically install and configre Active Directory integrated DNS zones. Even if yo choose to manally configre some settings later, the wizard saves time and prevents errors dring the initial configration.

5 Reviewing the Regional Domain Design 263 Reviewing the Regional Domain Design In preparation for deployment, gather and review all design information from the design team and ensre that the domain controller hardware yo plan to se meets the reqirements for Windows Server Reviewing the design involves two tasks, as shown in Figre 7.2. Figre 7.2 Reviewing the Regional Domain Design Review the regional domain design Collect regional domain design information Delegate the DNS domain for the new Review hardware reqirements Deploy the first domain controller in a new Deploy additional domain controllers in a new Reconfigre the DNS service Configre operations master roles

6 264 Chapter 7 Deploying Windows Server 2003 Regional Domains Collect Regional Domain Design Information Before yo begin the deployment, collect the design information that docments domain controller assignments. Record the compter name, static IP address, sbnet mask, and DNS client settings for each domain controller in the. For a blank worksheet to assist yo in docmenting this information, see Domain Controller Configration (DSSDFR_1.doc) on the Microsoft Windows Server 2003 Deployment Kit companion CD (or see Domain Controller Configration on the Web at Example: Reviewing the Regional Domain Design for Trey Research The design for Trey Research specifies deployment of a new, west.trccorp.treyresearch.net. This is a child domain of the dedicated Windows Server 2003 forest root domain, trccorp.treyresearch.net. Note The other in the example, east.trccorp.treyresearch.net, is created by pgrading a Windows NT 4.0 accont domain, then restrctring other Windows NT 4.0 resorce domains. Those portions of the example are covered in Upgrading Windows NT 4.0 Domains to Windows Server 2003 Active Directory, and Restrctring Windows NT 4.0 Domains to an Active Directory Forest in this book. The West domain will have domain controllers in two locations: Seattle and Los Angeles. Figre 7.3 shows an example of a completed controller configration worksheet for the West for Trey Research. For each domain controller, the preferred DNS server is the local domain controller, and the alternate is the closest DNS server. Initially, however, Trey Research configres the first domain controller in the domain to se a DNS server in its parent domain as its preferred DNS server. Dring installation of Active Directory on the first domain controller, the preferred DNS server is changed to the local domain controller. Then, after the second domain controller is online, Trey Research reconfigres the first domain controller to se the second domain controller as its alternate DNS server.

7 Reviewing the Regional Domain Design 265 Figre 7.3 Example of a Domain Controller Configration Worksheet Review Hardware Reqirements Ensre that each compter that yo plan to se as a domain controller meets the hardware reqirements for rnning Windows Server For more information abot assessing the hardware reqirements of domain controllers rnning Windows Server 2003, see Planning Domain Controller Capacity in this book.

8 266 Chapter 7 Deploying Windows Server 2003 Regional Domains Delegating the DNS Domain for the New Regional Domain The Active Directory DNS owner is responsible for delegating the zone matching the name of the to the DNS servers (domain controllers) that yo will be installing in the. Figre 7.4 shows when the DNS domain is delegated dring the deployment process. Figre 7.4 Delegating the DNS Domain for the New Regional Domain Review the regional domain design Delegate the DNS domain for the new Deploy the first domain controller in a new Deploy additional domain controllers in a new Reconfigre the DNS service Configre operations master roles

9 Delegating the DNS Domain for the New Regional Domain 267 Before yo create the new, delegate the DNS domain for the new Windows Server 2003 : In the forest root domain DNS zone. On any forest root domain controller. To delegate the DNS domain for the new 1. Open the DNS snap-in from any domain controller in the forest root domain. 2. In the console tree, right-click the forest root domain zone, and then click New Delegation. 3. Complete the New Delegation Wizard by sing the information docmented in yor Domain Controller Configration worksheet and the instrctions in Table 7.1. Accept the defalt settings when no information is spplied. Table 7.1 incldes sample data entered by Trey Research for their first two controllers, SEA-WEST-DC01 and SEA- WEST-DC02. Table 7.1 Delegating the DNS Domain for the Regional Domain Wizard Page Action Example Delegated Domain Name Name Servers In the Delegated Domain box, type the name of the. Click Add. In the New Resorce Record dialog box, in the Server name box, type the name of the first domain controller yo plan to deploy. In the New Resorce Record dialog box, in the IP address box, type the corresponding IP address of the domain controller, click Add, and then click OK. Click Add, and in the New Resorce Record dialog box, in the Server name box, type the name of another domain controller yo plan to deploy in the regional domain. In the New Resorce Record dialog box, in the IP address box, type the corresponding IP address of the other domain controller, click Add, and then click OK. west SEA-WEST-DC01. west.trccorp.treyrese arch.net SEA-WEST-DC02. west.trccorp.treyrese arch.net

10 268 Chapter 7 Deploying Windows Server 2003 Regional Domains Deploying the First Domain Controller in a New Regional Domain For each, the forest owner is responsible for deploying the domain controllers. Figre 7.5 shows the process for deploying the first domain controller in a new. Figre 7.5 Deploying the First Domain Controller in a New Regional Domain Review the regional domain design Delegate the DNS domain for the new Install Windows Server 2003 Deploy the first domain controller in a new Deploy additional domain controllers in a new Install Active Directory Verify the Active Directory installation Verify DNS server recrsive name resoltion Reconfigre the DNS service Configre operations master roles

11 Deploying the First Domain Controller in a New Regional Domain 269 Install Windows Server 2003 The first step in deploying a is to install Windows Server 2003 on the first compter that yo want to make the domain controller. Note Before installing Windows Server 2003, ensre that DNS was never previosly installed on the compter. If DNS was previosly installed, configration of the DNS resolver and forwarders might fail. Insert the Windows Server 2003 operating system CD in the CD-ROM drive of the domain controller and select the option to install the operating system, or se an atomated installation method. If the Windows Server 2003 media is shared on the network, rn the Winnt32.exe command. Use the NTFS file system to format the partitions. Enter the compter name, static IP address, and sbnet mask as specified by yor design. Configre the DNS client settings by sing the information docmented in the Domain Controller Configration worksheet. The DNS settings are temporary and will be changed after yo install Active Directory. Enable Remote Desktop for Administration (formerly known as Terminal Services in Remote Administration mode) to enable administrators to log on remotely if necessary. To enable Remote Desktop for Administration, in Control Panel, doble-click System, select the Remote tab, and then select Allow sers to connect remotely to this compter. Install Windows Spport Tools, which are available in the \Spport\Tools folder on the Windows Server 2003 operating system CD.

12 270 Chapter 7 Deploying Windows Server 2003 Regional Domains Install Active Directory Install Active Directory by rnning the Active Directory Installation Wizard on the compter that yo want to make the first controller. The Active Directory Installation Wizard creates the Active Directory database and initializes the directory data in the database. In addition, on the first domain controller in a domain, after yo rn the wizard and restart the compter, the wizard also: Prompts the administrator to verify the installation and configration of the DNS Server service. Configres DNS recrsive name resoltion by forwarding, by adding the IP addresses of the existing entries for Preferred DNS server and Alternate DNS server to the list of DNS servers on the Forwarders tab of the Properties sheet in the DNS snap-in for the domain controller. Configres DNS recrsive name resoltion by root hints, by adding the root hints that are configred on the Preferred DNS server. Note If yo want to set different forwarders, or do not want to enable forwarding, yo can change this setting manally by sing the DNS snap-in. If yor domain controller is mltihomed, forwarding is not configred atomatically. For manal configration instrctions, see Verify DNS Server Recrsive Name Resoltion later in this chapter. Configres the Preferred DNS server to point to the DNS server that is rnning locally on the domain controller, and configres the Alternate DNS server to point to the DNS server that is connected throgh the minimm nmber of network segments. To install Active Directory on the first controller 1. Log on to the Windows Server 2003 based member server. 2. Verify that yo can contact the parent DNS zone. At the command line, type: nslookp parent_domain (sing the flly qalified domain name of the parent DNS zone of the.)

13 Deploying the First Domain Controller in a New Regional Domain At the command line, type: dcpromo - or - Open Administrative Tools and click Configre Yor Server Wizard. Select Domain Controller (Active Directory) to configre yor domain controller. When the Configre Yor Server Wizard finishes, the Active Directory Installation Wizard begins. 4. Use Table 7.2 to complete the Active Directory Installation Wizard for the first domain controller in the. Table 7.2 also incldes information entered by Trey Research as they deploy their first controller, SEA-WEST-DC01. Table 7.2 Installing Active Directory on the First Domain Controller in a New Regional Domain Wizard Page or Dialog Box Action Example Domain Controller Type Create New Domain Network Credentials Child Domain Installation Select Domain controller for a new domain. Select Create a new child domain in an existing domain tree. In the User name box, type a ser accont that has sfficient rights to add a domain, typically a member of Enterprise Admins. In the Password box, type the password of the ser accont. In the Domain box, type the name of the forest root domain. Click Browse. In the Browse for Domain dialog box, click the Parent domain name, and then click OK. In the Child Domain box, type the NetBIOS name of the. Forest root domain: trccorp.treyresearch.net Parent domain: trccorp.treyresearch.net Child Domain: west NetBIOS Domain Name Confirm or type the NetBIOS name. WEST Database and Log Folders Type the folder locations specified by yor design. Database folder: C:\WINNT\NTDS Log folder: D:\Logs (contined)

14 272 Chapter 7 Deploying Windows Server 2003 Regional Domains Table 7.2 Installing Active Directory on the First Domain Controller in a New Regional Domain (contined) Wizard Page or Dialog Box Action Example Shared System Volme DNS Registration Diagnostics Permissions Directory Service Restore Mode Administration Password Confirm or type the location specified by yor design. A message will indicate that the wizard cannot contact the DNS server with which this domain controller will be registered. This is becase the pre-created delegation record points to the local compter and DNS has not been installed on the domain controller at this point. Select Install and configre the DNS server on this compter and set this compter to se this DNS server as its preferred DNS server. Select the secrity level specified by yor design: Permissions compatible with pre- Windows 2000 server operating systems Permissions compatible only with Windows 2000 or Windows Server 2003 operating systems In the Password and Confirm password boxes, type any strong password. C:\WINNT\SYSVOL Becase Trey Research crrently has server programs rnning on Windows NT 4.0 based servers, they selected Permissions compatible with pre-windows 2000 server operating systems. For more information abot installing and removing Active Directory, see the Directory Services Gide of the Microsoft Windows Server 2003 Resorce Kit (or see the Directory Services Gide on the Web at Verify the Active Directory Installation After yo rn the Active Directory Installation Wizard to install Active Directory, verify the Active Directory installation by performing the following tasks: 1. Review the Windows Server 2003 event log and resolve any errors. 2. At the command line, rn Dcdiag.exe and review and resolve any errors that are reported.

15 Deploying the First Domain Controller in a New Regional Domain Rn Task Manager and verify that the processor and memory system resorces are within acceptable limits. 4. Open the DNS snap-in, expand Forward Lookp Zones, and verify that the zones _msdcs.forest_root_domain_name and regional_domain_name are present. Verify DNS Server Recrsive Name Resoltion DNS server recrsive name resoltion is configred atomatically dring the Active Directory installation process. If yor design specifies a different configration, yo can se the DNS snapin or Dnscmd.exe to modify these settings. To verify name resoltion on the controller Use the DNS snap-in to verify DNS server recrsive name resoltion for the method sed in yor organization, based on the information in Table 7.3. Table 7.3 Information to Verify DNS Server Recrsive Name Resoltion Method Recrsive name resoltion by root hints Recrsive name resoltion by forwarding Configration Root hints are the recommended method to se for recrsive name resoltion in a Windows Server 2003 environment. No additional configration is necessary. When the DNS server specified as the Preferred DNS server dring the installation process is properly configred, the root hints are atomatically configred. To verify the root hints by sing the DNS snap-in: In the console tree, right-click the domain controller name, and then click Properties. Click the Root Hints tab to view the root hints. Only se Forwarders if that is what yor organization s design specifies. Root hints are the recommended method to se for recrsive name resoltion in a Windows Server 2003 environment. Forward nresolved qeries to specified DNS servers. To verify forwarding by sing the DNS snap-in: In the console tree, right-click the domain controller name, and then click Properties. On the Forwarders tab, in the selected domain s Forwarders list, verify that the IP addresses match those specified by yor design.

16 274 Chapter 7 Deploying Windows Server 2003 Regional Domains Deploying Additional Domain Controllers in a New Regional Domain Figre 7.6 shows the process for deploying additional domain controllers in a new regional domain. Figre 7.6 Deploying Additional Domain Controllers in a New Regional Domain Review the regional domain design Delegate the DNS domain for the new Deploy the first domain controller in a new Install Windows Server 2003 Deploy additional domain controllers in a new Reconfigre the DNS service Configre operations master roles Install Active Directory Install DNS Server service Verify the Active Directory installation

17 Deploying Additional Domain Controllers in a New Regional Domain 275 Install Windows Server 2003 Install Windows Server 2003 on additional compters by completing the same steps as for installing Windows Server 2003 on the first domain controller. Note that yo do not need to configre temporary DNS client settings on additional domain controllers; instead, enter the IP addresses of the DNS servers that are connected throgh the minimm nmber of network segments, as docmented in the Domain Controller Configration worksheet. For more information abot installing Windows Server 2003, see Install Windows Server 2003 earlier in this chapter. Install Active Directory Install Active Directory on the compter that yo want to make an additional controller by rnning the Active Directory Installation Wizard. Yo mst complete the Active Directory installation and verify that installation is correct on the first domain controller before beginning installation of Active Directory on the second and sbseqent domain controllers in the domain. For more information abot verifying the Active Directory installation on the first controller, see Verify the Active Directory Installation earlier in this chapter. The procedre for installing Active Directory on additional domain controllers in a domain differs slightly from the procedre for installing Active Directory on the first domain controller. For additional domain controllers in an existing domain, yo have the option of sing the install from media featre, which is new in Windows Server Install from media allows yo to prepoplate Active Directory with System State data backed p from an existing domain controller. This backp can be present on local CD, DVD, or hard disk partition. Installing from media drastically redces the time reqired to install directory information by redcing the amont of data that is replicated over the network. Installing from media is most beneficial in large domains or for installing new domain controllers that are connected by a slow network link. To se the install from media featre, yo first create a backp of System State from the existing domain controller, then restore it to the new domain controller by sing the Restore to: Alternate location option. To install Active Directory on additional controllers 1. Log on to the Windows Server 2003 based member server. 2. If yo want to copy domain information from restored backp files, at the command line, type: dcpromo /adv or If yo want to copy domain information over the network, either type dcpromo (withot the /adv switch) or open Administrative Tools, click Configre Yor Server Wizard, and select Domain Controller (Active Directory).

18 276 Chapter 7 Deploying Windows Server 2003 Regional Domains Use Table 7.4 to complete the Active Directory Installation Wizard for sbseqent domain controllers in the. Table 7.4 incldes information entered by Trey Research as they deploy their second controller, SEA-WEST-DC02. Table 7.4 Installing Active Directory on Additional Domain Controllers in a New Regional Domain Wizard Page or Dialog Box Action Example Domain Controller Type Copying Domain Information Global Catalog Network Credentials Additional Domain Controller Select Additional domain controller in an existing domain (This dialog box appears only when yo started dcpromo with the /adv switch or sed the Configre Yor Server Wizard.) Select either: Over the network from a domain controller From these restored backp files (This dialog box appears only when From these restored backp files was selected, if the domain controller yo backed p was a global catalog server.) Specify whether to configre this domain controller as a global catalog server. In the User name box, type a ser accont that has sfficient rights to add a domain controller, typically a member of Domain Admins. In the Password box, type the password of the ser accont. (This dialog box appears only when Over the network was selected.) Confirm or type the fll DNS name of the forest root domain. Trey Research is copying from the first WEST domain controller, SEA- WEST-DC01, which is in the same location, so they selected Over the network to copy the information in the shortest time. west.trccorp.treyresearch. net (contined)

19 Deploying Additional Domain Controllers in a New Regional Domain 277 Table 7.4 Installing Active Directory on Additional Domain Controllers in a New Regional Domain (contined) Wizard Page or Dialog Box Action Example Database and Log Folders Shared System Volme Directory Service Restore Mode Administration Password Type the folder locations specified by yor design. Confirm or type the location specified by yor design. In the Password and Confirm password boxes, type any strong password. Database folder: C:\WINNT\NTDS Log folder: D:\Logs C:\WINNT\SYSVOL For more information abot installing and removing Active Directory, see the Directory Services Gide of the Microsoft Windows Server 2003 Resorce Kit (or see the Directory Services Gide on the Web at Install DNS Server Service After Active Directory installation has finished and the compter has restarted, install DNS on the additional Windows Server 2003 based domain controller that is added to the domain. To install DNS on additional domain controllers sing the Windows Components Wizard 1. Click Start, point to Settings, and click Control Panel. 2. Doble-click Add or Remove Programs, and then click Add/Remove Windows Components. 3. In Components, select the Networking Services check box, and then click Details. 4. In Sbcomponents of Networking Services, select the Domain Name System (DNS) checkbox, click OK, and then click Next. 5. If prompted, in Copy files from, type the fll path to the distribtion files and then click OK. The reqired files will be copied to yor hard disk. Verify the Active Directory Installation Use the same steps as shown in the procedre for the first domain controller, bt instead of verifying that DomainDnsZones and ForestDnsZones were created, se the repadmin /showreps command to verify that the ForestDnsZones and DomainDnsZones application partitions are replicated sccessflly. Use the DNS snap-in to verify that DNS server recrsive name resoltion is configred according to the method sed by yor organization. For more information abot verifying the Active Directory installation, see Verify the Active Directory Installation earlier in this chapter.

20 278 Chapter 7 Deploying Windows Server 2003 Regional Domains Reconfigring the DNS Service Reconfigre the DNS service to enable aging and scavenging of stale resorce records and to accont for the additional domain controllers in the. Figre 7.7 shows the process for reconfigring the DNS service. Figre 7.7 Reconfigring the DNS Service Review the regional domain design Delegate the DNS domain for the new Deploy the first domain controller in a new Deploy additional domain controllers in a new Reconfigre the DNS service Configre operations master roles Enable aging and scavenging for DNS Configre DNS client settings of the first and sbseqent domain controllers Update the DNS delegation for the

21 Reconfigring the DNS Service 279 Enable Aging and Scavenging for DNS Enable aging and scavenging on two Windows Server 2003 based domain controllers rnning the DNS Server service per domain, to allow atomatic cleanp and removal of stale resorce records (RRs), which can accmlate in zone data over time. With dynamic pdate, RRs are atomatically added to zones when compters start on the network. However, in some cases, they are not atomatically removed when compters leave the network. For example, if a compter registers its own host (A) RR at startp and is later improperly disconnected from the network, its host (A) RR might not be deleted. If yor network has mobile sers and compters, this sitation can occr freqently. If left nmanaged, the presence of stale RRs in zone data might case problems inclding: If a large nmber of stale RRs remain in server zones, they can eventally take p server disk space and case nnecessarily long zone transfers. DNS servers loading zones with stale RRs might se otdated information to answer client qeries, potentially casing the clients to experience name resoltion problems on the network. The accmlation of stale RRs at the DNS server can degrade its performance and responsiveness. Cation By defalt, the aging and scavenging mechanism for the DNS Server service is disabled. Enable aging and scavenging only after yo nderstand all parameters. Otherwise, the server cold be accidentally configred to delete resorce records that shold not be deleted. If a resorce record is accidentally deleted, not only will sers fail to resolve qeries for that resorce record, bt any ser can create the resorce record and take ownership of it, even on zones configred for secre dynamic pdate. For more information abot how to configre aging and scavenging, see Understanding aging and scavenging in Help and Spport Center for Windows Server 2003.

22 280 Chapter 7 Deploying Windows Server 2003 Regional Domains To enable the aging and scavenging featres, perform the following steps to configre the applicable server and its Active Directory integrated zones: Enable aging and scavenging at the server. These settings determine the affect of zone-level properties for any Active Directory integrated zones loaded at the server. Enable aging and scavenging for selected zones at the DNS server. When zone-specific properties are set for a selected zone, these settings apply only to the applicable zone and its resorce records. Unless these zone-level properties are otherwise configred, they inherit their defalt settings from comparable settings maintained in the DNS server aging/scavenging properties. To set aging and scavenging properties for the DNS server 1. Log on to the compter that is rnning the DNS Server service with an accont that is a member of the local Administrators grop. 2. In the DNS console tree, right-click the applicable DNS server, and then click Set Aging/Scavenging for all zones. 3. Select the Scavenge stale resorce records check box. 4. Modify other aging and scavenging properties as needed. To set aging and scavenging properties for a zone 1. Log on to the compter that is rnning the DNS Server service with an accont that is a member of the local Administrators grop. 2. In the DNS console tree, right-click the applicable zone, then click Properties. 3. On the General tab, click Aging, and then select the Scavenge stale resorce records check box. 4. Modify other aging and scavenging properties as needed.

23 Reconfigring the DNS Service 281 Configre the DNS Client Settings of the First and Sbseqent Domain Controllers After yo have deployed an additional domain controller, modify the DNS client settings on the first domain controller. Becase no other domain controllers were rnning when yo deployed the first domain controller, modify the DNS client settings on the first domain controller to inclde the additional domain controller. As yo deploy more domain controllers, yo might also need to modify the Alternate DNS server setting specified on existing domain controllers to ensre that this setting points to the DNS server that is connected throgh the minimm nmber of network segments. To configre the DNS client settings on previosly installed domain controllers 1. Open Network Connections, doble-click yor Local Area Connection, click Properties, click Internet Protocol (TCP/IP) to highlight it, and then click Properties. 2. For the Preferred DNS server, type the IP address of the DNS server that is rnning locally on the domain controller (local host). 3. Determine whether a newly installed domain controller is now closer to this domain controller than the domain controller that yo originally specified as the Alternate DNS server. If it is, for Alternate DNS server, type the IP address of the newly installed domain controller. Update the DNS Delegation for the Regional Domain Before yo deployed the first controllers, the DNS administrator delegated the DNS domain for the new. Dring that process, the DNS administrator added DNS name server (NS) and address (A) resorce records to the parent DNS zone for each planned domain controller in yor design. If yo deploy additional domain controllers that yo have not previosly created resorce records for, pdate the DNS delegation. Yo can pdate the DNS delegation by sing the DNS snap-in on any forest root domain controller, as described in Delegating the DNS Domain for the New Regional Domain earlier in this chapter.

24 282 Chapter 7 Deploying Windows Server 2003 Regional Domains Configring Operations Master Roles Configre operations master roles to ensre the availability and performance of those domain controllers. Figre 7.8 shows when configring operations master roles occrs in the regional domain deployment process. Figre 7.8 Configring Operations Master Roles Review the regional domain design Delegate the DNS domain for the new Deploy the first domain controller in a new Deploy additional domain controllers in a new Reconfigre the DNS service Configre operations master roles

25 Configring Operations Master Roles 283 It is generally recommended that yo leave the operations master roles on the first domain controller in the. Monitor this domain controller closely and ensre that it is not a global catalog server. Deploy an additional domain controller in the same site to act as the standby operations master. Host the PDC emlator role on a powerfl and reliable domain controller to ensre that it is available and capable of handling the workload. Of all the operations master roles, the PDC emlator role has the highest impact on the performance of the domain controller hosting that role. In domains with more than 10,000 sers, it might be necessary to redce the nmber of athentication reqests performed by the PDC emlator to decrease its workload and allow it to perform other tasks. If CPU tilization is higher than 50 percent or disk qees remain higher than 2 for several hors or days, redce the nmber of client athentication reqests received by the PDC emlator. Note Other factors that can increase the workload on the PDC emlator inclde pre-active Directory clients or applications that have been written to contact the PDC emlator. To redce the nmber of client athentication reqests that are processed by the PDC emlator, adjst its weight or its priority in the DNS environment. If yo want to proportionately redce the nmber of client athentication reqests received by the PDC emlator, adjst its weight. If yo want to ensre that the PDC emlator does not receive any client athentication reqests, adjst its priority. Active Directory assigns a defalt vale of 100 for the weight. By creating a new registry entry for the weight and assigning it a decreased vale of 50, yo can proportionately redce the nmber of client athentication reqests sent to the PDC emlator. This ensres that the PDC emlator will athenticate half of the nmber of clients that it wold if the weight vale remained at 100. Active Directory assigns a defalt vale of zero for the priority. By creating a new registry entry for the priority and assigning it an increased vale of 200, yo can ensre that the PDC emlator will never receive client athentication reqests nless it is the only accessible domain controller. Repeat these procedres if the PDC emlator operations master role is transferred or seized to another domain controller in the forest root domain. Cation The registry editor bypasses standard safegards, allowing settings that can damage yor system, or even reqire yo to reinstall Windows. If yo mst edit the registry, back it p first and see the Registry Reference on the Microsoft Windows Server 2003 Deployment Kit companion CD or on the Web at

26 284 Chapter 7 Deploying Windows Server 2003 Regional Domains To change the weight for DNS SRV records by sing the registry 1. In the Rn dialog box, type regedit, and press ENTER. 2. In the registry editor, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CrrentControlSet\Services\Netlogon\Parameters. 3. Click Edit, click New, and then click DWORD vale. 4. For the new entry name, type LdapSrvWeight and press ENTER. (The vale name is not case sensitive.) 5. Doble-click the entry name yo jst typed to open the Edit DWORD Vale dialog box. 6. Choose Decimal as the Base option. 7. Enter a vale from 0 throgh The recommended vale is Click OK. 9. Click File, and then click Exit to close the registry editor. Adjsting the priority of the domain controller also redces the nmber of client referrals. However, rather than redcing it proportionally to the other domain controllers, changing the priority cases DNS to stop referring all clients to this domain controller nless all domain controllers with a lower priority setting are navailable. Note A lower vale entered for LdapSrvPriority indicates a higher priority. A domain controller with an LdapSrvPriority setting of 100 has a lower priority than a domain controller with a setting of 10. Therefore, clients attempt to se the domain controller with the setting of 10 first. To change the priority for DNS SRV records by sing the registry 1. In the Rn dialog box, type regedit, and press ENTER. 2. In the registry editor, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CrrentControlSet\Services\Netlogon\Parameters 3. Click Edit, click New, and then click DWORD vale. 4. For the new entry name, type LdapSrvPriority, and press ENTER. 5. Doble-click the entry name that yo jst typed to open the Edit DWORD Vale dialog box.

27 Additional Resorces Choose Decimal as the Base option. 7. Enter a vale from 0 throgh The recommended vale is Click OK. 9. Click File, and then click Exit to close the registry editor. For more information abot adjsting the weight or the priority of the PDC emlator, see the Active Directory link on the Web Resorces page at Search nder Administration and Configration Gides and download the Active Directory Operations Gide. Additional Resorces These resorces contain additional information and tools related to this chapter. Related Information Designing the Active Directory Logical Strctre in this book. Designing the Site Topology in this book. Upgrading Windows NT 4.0 Domains to Windows Server 2003 Active Directory in this book. The Active Directory Branch Office Planning Gide link on the Web Resorces page at for a complete gide to information involving Active Directory branch office implementations. The Active Directory link on the Web Resorces page at Search nder Administration and Configration Gides and download the Active Directory Operations Gide. Related Help Topics For best reslts in identifying Help topics by title, in Help and Spport Center, nder the Search box, click Set search options. Under Help Topics, select the Search in title only checkbox. Active Directory in Help and Spport Center for Windows Server Windows Spport Tools nder Tools in Help and Spport Center for Windows Server Related Job Aids Domain Controller Configration (DSSDFR_1.doc) on the Windows Server 2003 Deployment Kit companion CD (or see Domain Controller Configration on the Web at

28