Home › Deploying domain controllers › Step 6
Best practices for virtualising domain controllers
Step 6 of 6 in Deploying domain controllers · video 3:22
What you will learn
- Avoiding single points of failure with virtual DCs
- Keeping time consistent between hosts and DC guests
- Why checkpoints are risky and how safeguards change that
- Cloning in batches and planning names for clones
About this lesson
Virtual domain controllers bring hardware independence, better use of resources and easier scaling, but they need some care so that AD DS is not put at risk. The lesson lists the main practices. Run at least two virtual DCs per domain on different hosts, and spread them across hardware, storage, networks and, ideally, data centres or regions. Make sure hosts and guests belong to the same time infrastructure and keep the same time. Choose a hypervisor that supports the virtual machine generation identifier and run Windows Server 2012 or later guests, so that the virtualisation safeguards and cloning work. Where those safeguards are missing, prevent checkpoints entirely, for example with a pass-through disk; even with safeguards, avoid them. Treat virtualisation administrators as being as trusted as domain admins. The lesson ends with cloning guidance: start no more than 10 clones at once, move clones to branch sites during off-peak hours, and plan a naming scheme that allows for clone names.
Check yourself
1. What is the minimum number of virtual domain controllers per domain the lesson recommends, and where should they run?
At least two, on different virtualisation hosts, so that the failure of one host cannot take out every domain controller in the domain.
2. What does the lesson advise about time on the hypervisor host and its domain controller guests?
All of them should take part in the same time service infrastructure, and host and guest clocks must not differ, because AD DS relies on accurate time, for example for Kerberos authentication.
3. What should you do about checkpoints on a virtual DC whose host or guest does not support the virtualisation safeguards?
Make checkpoints impossible, for example by giving the DC a pass-through disk instead of a virtual hard disk, because rolling a DC back to an old checkpoint without safeguards can damage directory replication.
4. You need 30 new domain controllers from clones. Why should you not start them all at once?
The file replication used for SYSVOL allows only 10 replication connections at the same time, so clones should be started in batches of 10 at most.
Go deeper
This lesson comes from the course below - with the full set of lessons, demonstrations and practice.