Windows Hello for Busniness DC Locator Process

Question

We are running a WHfB pilot with users around the world. We have an environment with about 150 DCs globally. Currently there are about 50 2019 DCs spread around the place with the others being 2012 R2. WHfB will only talk to 2019 DCs, which is expected, but what I'm seeing is if the the user isn't in a site with a 2019 DC the locator process is selecting a random 2019 DC rather than one close to the user based on site link costs, and this is leading to a poor logon experience in some cases. Our site link architecture is rock solid and users that aren't on the WHfB pilot get the correct DC for their given site.

So from what I can see the logic for WHfB seems to be: Can I find a 2019 DC in my current site? If yes then use it, if no then go off and find any other random 2019 DC. I thought it would first look at the cost to get to the 2019 DCs before selecting one. Is there any way to change this behaviour?

Cheers
C

Answer 1

Hello there,

Usually, it should locate the nearest DC, have you created any priority list within the DC selection by Windows Hello?

By default, DC Locator does not consider any site that contains a read-only domain controller (RODC) when it determines the next closest site. In addition, when the client gets a response from a domain controller that runs a version earlier than Windows Server 2008, the DC Locator behavior is the same as when then the setting is not enabled.

DC locator process is a feature provided by Microsoft domain controller that provides your clients and servers the ability to contact the closest available domain controller within an AD Domain. DC Locator is an algorithm that runs over the Net Logon service on the client's computer.

Similar discussion here https://social.technet.microsoft.com/Forums/systemcenter/en-US/02328bd6-5f5b-4d26-9b7f-2edb42ef61b4/dc-locator-records-in-dns-and-priorities?forum=winserverDS

https://learn.microsoft.com/en-us/answers/questions/829357/windows-hello-for-business-dc-locator-process.html

----------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer–

Answer 2

Hi There,

I'm not sure what you mean by a "priority list" for Windows Hello, can you clarify please?

I know how the DC locator process works outside of Windows Hello and like I said in my post that is working fine for non-WHfB clients. It's the WHfB clients that aren't in a site that has a 2019 DC that are the issue.

Cheers
C