Running a Domain Controller on a VM

Django x2 · 4 Feb 2010 at 09:18

Using Hyper V. Am I likely to come across any issues?

Basically we're upgrading the PDC to 2008R2 (currently 2003). I want to build a 2008R2 VM, dcpromo it, let it replicate, make it authorative / primary, etc then rebuild the real DC server with 2008R2, dcpromo it then make that the PDC again.

Is this the best way to do it?

The DC VM will be temporary but I don't want to run in to any issues

Saundie · 4 Feb 2010 at 09:30

I've run DCs in VM permanently in a production environment without any issues. One thing that you will need to make sure of is that the PDC is properly configured to obtain the correct time from an external SNTP server, and that you disable the integration service for setting the VM to the host's time. If you fail to do this, you could end up with the system clocks becoming vastly out of sync across your domain, which is a Very Bad Thing indeed!

Django x2 · 4 Feb 2010 at 09:32

yeah, I'd read a bit in to that.

Any links for setting up the time with an external SNTP server?

Thanks

Saundie · 4 Feb 2010 at 09:35

This is the article I refer to;

http://support.microsoft.com/kb/816042

As for your promotion/demotion method, that's the process I used when I migrated my DCs to VMs, but I am not sure if it's the recommended way of doing it.

Django x2 · 4 Feb 2010 at 09:44

Thanks, whats the peers bit about, do I list the external time source there?

Saundie · 4 Feb 2010 at 09:51

Indeed. On my DC I have set the key

Code:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\NtpServer

To use the value;

Code:

time.windows.com,0x1

Although you can use any time server you desire.

Django x2 · 4 Feb 2010 at 11:02

Sweet, thanks

Moredhel · 4 Feb 2010 at 19:04

I would never make the domain controllers totally virtual in production, you could end up with a sort of chicken and egg situation if something made everything shut down where your hypervisors come up without being able to authenticate against the domain.

We have a few virtual DCs, most of which hold the global catalog etc. but we have a physical server that holds all the FSMO roles too.

Django x2 · 4 Feb 2010 at 19:05

This is actually the issue I'm facing now. A VM DC is running but I can't remote access the hyper v box to change its DNS to the new DC. A visit to site tomorrow methinks!