Specing new domain controllers

glenimp617

glenimp617

glenimp617

Soldato
Joined
30 Sep 2005
Posts
16,735
Hi all,

I'm working for a new company and just started my second project.

Doing a complete domain refresh from 2003 to 2008 R2, then eventually to 2012. Current servers are 9 years old so much needed love and attention.

The issue I'm having is that everything needs proving. Management want a report detailing what we need and WHY we need it.

30,000 active users in AD

Locations:

Main site with the majority of users (70%), this also has another building close by connected to 100mb eLAN.

5 remote sites: 1 connected via gig link, the others are 100mb


They already have 5 dell r310 servers with xeon cpu, 8gb ram, 2 x 15k sas disks. They are still sat in their box. Thinking I could use those to keep costs down. Would have 3 at the main site, buy a new one for the eLAN building and 1 server at each of the remote sites.

My report goes over the general stuff like fsmo roles, site replication, topology, dns, dhcp redundancy etc etc

The thing I'm struggling with is the what we need and why we need it. They are asking questions like, how many users does it need to reach at the remote sites before a server is required. Or, how much bandwidth do we need at the sites. They are after hard numbers.

It's things like, why do we need three servers are the main site. Why 8gb ram.

I've ran performance counters on hardware and ntds but I can't find any hard and fast rules for specing domain controllers.

Appreciate your help

Thanks!!
 
Last edited:
We've just done something similar at work, moved from 6 year old Win 2003 DCs to new 2008R2 servers.

The business case should write itself as running AD on 9 year old hardware for 30,000 users seems a bit mental! (One day downtime for the entire business would probably pay the hardware costs many times over). I explained it like - imagine you come in to work in the morning and no-one can log on, get to any network shares, internet, email, VOIP (DHCP), printing. It just isn't worth scrimping on in my opinion.

There must be Microsoft guidance on DC speccing and sizing?

I think we ended up with 5 servers with Dual Xeons, 16gb ram and 5/6 x SAS disks each (mirroring the OS and having the DB/logs on seperate raid disks). This is for 5500 users.
 
Yeah, you and I know that but management want it all spelling out bit by bit.

That hardware looks a little overkill to be honest but I'm sure it's nice and fast :D How did you come up with knowing how many DCs and hardware specs for your environment?
 
(One day downtime for the entire business would probably pay the hardware costs many times over).

This would nevber happen if you have more than one DC (Which you should have)

Each site should have its own DC (IMHO) as if the comms link is down then the site is dead in the water. Usually the DC would also host some of the DHCP & DNS roles, unless the site is so big that dedicated DHCP & DNS roles are required.

I dont get the point in seperate disk packs for the AD Db, the file is tiny, as long as the servers OS drive is sutably protected, RAID5 is enough, with the obligatry hotspare. It does not need fast disks, as the DB is in RAM during use. 16GB Ram is also overkill, but justifiable with the price at the moment.
 
Last edited:
Thanks Dusty,

That's pretty much what my research has shown

One DC at every site to offload the main site and give peace of mind if the WAN link fails. This will also provide DHCP for its own sites subnet.

Quad Xeon with 8gb ram, raid-1 SAS 15k disks. The AD database is 660mb so I think this will be enough to be honest

3 servers at the main site, with one at the other building should be plenty IMHO. That said, I really welcome everyones comments.

I'm really struggling with the question 'how many users at a remote site warrants its own server' and 'how much bandwidth do they need'

It's kind of like how long is a piece of string. Let's say each user needs 1mb of data when logging in. If the site has 100 users it doesn't mean you need 100mb wan link. Grrrr

I just want to get on with the project
 
Last edited:
One user at a remote site in my book constitues a need for a DC.

If the link is down the user is stuffed. you could leverage the use of an RODC on an existing print server, this could negate the need for its own pure DC, and also limit the risk of the site being compromised.

The bandwidth question is all based aroung what they do, and where there data is. If their data is local then the bandwidth they need is tiny. If their data is remote then they need more bandwidth, but not all the time, or they suffer slower speeds, and put up with it.
 
Last edited:
Does a single user warrant a DC though?

If the link is down, they will still be able to login through cached credentials. Email and Internet won't work anyway leaving just their own personal data. 'if' that is stored centrally they are stuffed unless they have offline files or branch cache.

unless I'm missing something (probably lol)

I like the idea of an RODC, but what about in a DR situation. If the main site goes down, how will the admins gain access to the network if all that's left are RODCs (then again, to be honest in that situation I think that's the leave of peoples worries haha)
 
Its all about how much the business can afford to loose in lost productivity.

Also the main site should have more than one writable DC, so the loss of one DC is not an issue, the loss of them all temporarily is not an issue.

The total loss of all of the writable DC's is sackable
 
DustyMiller said:
Its all about how much the business can afford to loose in lost productivity.

Also the main site should have more than one writable DC, so the loss of one DC is not an issue, the loss of them all temporarily is not an issue.

The total loss of all of the writable DC's is sackable
Click to expand...

agree, but if all writable DCs are in the main site, and only RODC are remote sites. If we lost the main site we'd be screwed wouldn't we.

I think I will end up only having RODCs at very small sites
 
DustyMiller said:
One user at a remote site in my book constitues a need for a DC.

If the link is down the user is stuffed. you could leverage the use of an RODC on an existing print server, this could negate the need for its own pure DC, and also limit the risk of the site being compromised.
Click to expand...
In an ideal world, yes. However, supporting the infrastructure needed for a DC at a small remote site costs money, too. And it is a recurring cost, whereas the loss of productivity caused by an outage is a one-off. And if the link goes down, then most likely the business apps are remote anyway (file, application, web servers), so you haven't gained a lot by having the DC locally (the user is still not productive). And to confirm what someone else mentioned, cached credentials will allow the users to login in the absence of a DC; so again, the temporary loss of connectivity to a DC is mitigated in several ways.

Everything has pros and cons; just bear in mind that ongoing support of remote systems is non-trivial in both effort and cost.

To address the original post about management asking "difficult" questions: it's their money, so they have every right to ask questions. The fact that they are asking those questions implies they have been burned in the past, probably multiple times, and have no confidence in their techies. Writing a kick-ass document, and delivering a great solution, is a step in the direction of earning that trust back.

I found this:
http://download.microsoft.com/downl...ning_Domain_Controller_Capacity_version_2.doc

It's dated, but offers some pretty good guidelines.
 
Totally agree ^ I'm using the 2008 IPC white paper but yours look equally as good with the graphs.

I think every business is different which makes it hard to find hard and fast numbers. Should be ok.

Documents looking pretty good :D
 
I disagree, but its all about cost / benefit.

If the site has poor connectivity, then moving as many roles / functions to the site is important.

If the user not being able to logon, (and cached credentials in a more secure environment are disabled), then a DC of some kind is important, even if it is a role on another server. It's all about money at the end of the day.
 
Good point of reference for hardware requirements:

http://social.technet.microsoft.com...ing-for-active-directory-domain-services.aspx

The first reply spoke volumes - consider that no-one can logon - what is the cost to the business? Quite a lot I suspect. This has to be the main consideration in your solution.

A couple of basic pointers:

Size of NTDS.DIT - make sure that you have enough memory in every DC to cache the database, plus the usual OS overhead. I would expect 8GB per Domain Controller would be sufficient for a 30,000 user AD.

Remote DCs - no need unless there are remote resources (i.e. file servers, Exchange servers) that would be affected by loss of authentication services. If just workstations then I would expect that allowing cached credentials is enough to get users on to their workstations, and if all file servers, etc are in central site then loss of network connection means it's all inaccessible anyway.

Cost of Support - if you place one DC at a site, then surely you should put 2 there for resiliency??? How much does it cost you to support these compared to business impact if WAN link to central DCs is lost?

Bandwidth requirements - how many GPOs are being processed, how often do they change and how many groups are users members of - all of these and the rate of change impacts the bandwidth impact to a remote site without a DC. I've worked with global customers who don't have local DCs and everything is fine providing you're not running a shed load of scripts through GPO. Remeber, GPO is only re-processed if it changes, otherwise it has literally no impact over a slow(ish) link

Number of DCs - consider whether the loss of a single DC leaves you with enough capacity to retain normal service to the estate. For example, if you had 2 data centres with all your DCs in, would the loss of an entire data centre leave you with sufficient capacity to support all your users at acceptable performance.
 
You must log in or register to reply here.
Back
Top Bottom