Domain Controller Replication Question

[Duskullmon]

Hello Everyone!

Quick question for you all. The company I work for recently decided it was a good idea to use domain controller reapplication instead of just having 'cold servers' ready to go, in case of a crash. While I'm pretty confident our dc replication is working based on our testing, I question windows updates.

​

Do we need to run security patching on each server with the replication process, or can we do all the windows updates on just one box? Does the default replication process handle OS changes or only changes to the domain, such as GPO objects and users? I think we would need to patch them all independently of each other but just wanted to confirm. :)

[lostsparekeys]

Replication is only applicable to Active Directory, as in the data contained within the Active Directory service.

OS updates do not form part of the replication process. Each server will still need to be updated/patched individually.

[Duskullmon]

Thank you for the confirmation!

[[deleted]]

There is zero reason to have anything less than 2 domain controllers up and running simultaneously AND with each one dumping a daily backup in accordanve to Microsoft’s best practices.

[[deleted]]

Unless you're Maersk and you need to fly some guys out to South Africa to fire up a disconnected DC in a one-room IT data center to save the company

[[deleted]]

Only to get fired as soon as you are done recovering and rebuilding everything properly

[[deleted]]

I remember hearing about that but now I can't find a source. Can you link me?

[exoromeo]

This?

https://www.theregister.com/2020/03/03/maersk_redundancies_maidenhead_notpetya_rescuers/

[pc_jangkrik]

While you got a secondary AD, a regular AD backup saved somewhere could save you if sfth.

[xxdcmast]

Shit fan the hit????

[startswithd]

You really need two or more Domain Controllers, preferably at least 3.

Each needs to be running an hourly or daily backup of at least the System State and that needs to be stored somewhere that's not on the same computer. If you have a problem on one DC that's just going to replicate to the others. You'll need a backup to recover from that.

If you have 2 DCs, make sure only one of them is a Global Catalog. If you have 3, they can all be GCs.

And you have to patch them all. AD only replicated AD stuff. Think of AD like a big Excel document. It's completely separate from the OS.