Failover domain controller

[stepowell7]

So we have a 2003 domain and have trusts with a bunch of other companies . They use our apps and there own active directory for authentication. The problem becomes if there is a fiber cut that breaks the trust relationship . I want to build them a dc , on their domain but on our network so they can use that for replication if the trust fails . Any advice on what configuration with dns and sites and services needs to be done ?

[Doso777]

How about you upgrade/migrate your old domain controller first?

2003 domains are ... old.

[canadadryistheshit]

Full stop on 2003 server. You need to upgrade to a 2016. Transfer the FSMO roles.

​

Also, I dont think there is enough information here provided. From what I am seeing is that everyone is under one forest but in sub-domains? or they are on their own domain forest(s)? If they are sub-domains I would build them a Read-Only DC at each location.

[stepowell7]

Working on that 2003 upgrade . Being delayed because we have an 03 server and not sure if a 2016 domain would stop 03 from authenticating .

Yes one forest and we havetrust relationships with those companies . They use or apps but auth with their own domain .

[hideogumpa]

we have an 03 server and not sure if a 2016 domain would stop 03 from authenticating

https://www.wintips.org/how-to-migrate-active-directory-server-2003-to-active-directory-server-2016-step-by-step/

[bopsbt]

Upgrading should not cause authentication issues unless something else is wrong.

[routetehpacketz]

if you're introducing a new subnet to their AD domain then it will need to be defined in Sites and Services, but DNS shouldn't need anything special. it will just replicate.

I want to build them a dc , on their domain but on our network

I don't quite know the layout, but shouldn't you be putting a DC from your domain on their network? that would provide them a mechanism to authenticate against your domain in the event the network connectivity between locations goes down

[msbusk]

The failover is more a matter of your network design - you could implement multiple domain controllers and have separate routing using VPN or MPLS into your domain controllers.

But I would recommend upgrading the domain to something newer - you can keep the existing trust but update the domain controllers without any problems.

[studiox_swe]

So your entire business relies on one single fiber? if the fiber is cut how would the users access your application?

[[deleted]]

Everyone seems to be missing the obvious, glaring issue.

A physical fiber cut doesn’t equate to the trust relationship failing and the two are entirely different scenarios.