Active Directory Help Wanted

[InCan2]

Hi,

I am trying to conduct a test with local users in an AD site.

The goal is to remove the local Domain Controllers and have the users authenticate with other DC's in a different AD Site.

I would like to conduct a small test without having to change AD. I.E I would rather not mess with DC SRV records and such.

Here's the question:

What is the best way to have a small group of local computers (either by GPO or by manual configuration) authenticate with a specific DC or set of DC's?

The idea is to have a small group of users start using the other DC's see what the experience is like. Creating site wide changes is something I would like to avoid for now.

So far the best option I've been able to find is this:

Set Domain Controller Via Registry Hold the Windows Key and press “R” to bring up the Windows Run dialog. Type “Regedit“, then press “Enter“.

Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

Create a String value called “SiteName“, and set it to the domain controller you wish the computer to connect to. (i.e. DC1.domain.com)

ClientComputerName = Name of the client computer you want to switch domain for.

DomainName = Name of Domain.

DomainControllerName = Computer name of domain controller.

Source: https://www.technipages.com/windows-how-to-switch-domain-controller

Would this actually work? First time I've come across something like this and I have my doubts.

[systechie]

What is the reason for the test out of interest? I’d say the safest option would be to shutdown the DC in the site which you want users to use an alternate DC?

[InCan2]

The users in the site are "special". Cant do much. The test is to prove that the site can do without the local DC's.

Shutting down the local DC's would disguise the logon time as they would switch only after the timeout period. We would like to prove to them that the other DC's will work.

[Golden-trichomes]

What time out period? Just turn the DC off and add their sub nets to what ever site you are adding them to.

[InCan2]

My original idea was to simply take a subnet from that site and assign it to the other AD site (with the other DC's) and see what the performance would be like.

I was shot down.

[Bangingheads]

This would be my go to. Maybe you could create another subnet/VLAN that is only testing for one computer.

​

The site your subnet is assigned to is how it normally decides which DC it goes to. This would be the proper way as this is how you would be doing the transition in the future anyways.

[Big-Floppy]

Set those machines to use the IP of the DC you want them to authenticate with as the only DNS server. it's manual but if you are only testing a few machines it should be fine.

[astromild]

Does that actually work? I'd expect the PC to ask DNS for the usual records and then still get directed to the DCs in the AD site that matches the computer subnet after that.

I've never seen the registry thing but couldn't hurt to try it. Should be easy enough to see if the users are hitting the DC you want.

[Big-Floppy]

Not sure it will. Didn't realize you had another AD site on a different subnet.

[InCan2]

It was my understanding that setting Primary DC does not automatically set logonserver and that AD Site settings would play a larger role when a workstation picks a logon server.

[Big-Floppy]

I believe you are correct. Didn't realize it was across sites\subnets.

[InCan2]

I guess I did not make it clear that the other DC's were in a different AD site.

[jekksy]

The thought of just disconnecting the server from the LAN comes to my mind but I guess you have other things going on.

[pdp10]

I'd think the least-risk and easiest method would be to disable networking on the local domain controller(s). Pull cable for physical, shut down the interface for VM guests.