How to avoid clients reaching specific DomainController?

OskarPrez 0 Reputation points

Hello all, apologies for my english, I hope you can help me please, considering this: I have a network with 2 vlans, one for serves, another for local PCs 3 Domain controllers DC1 physically in the same network as PCS DC2 physically in the same network as PCS DC3, this one is in a remote network, reached by a VPN My local clientes network configuration is given by DHCP server, in the network, with specific DNS IP address PrimaDNS Secondary So, the issue is that I do not want my clients reaches the DC3, since it is not necesary, and also because it is in a remote site over VPN. when I ping mydomain.local from different computers, sometimes it replies with the DC3 IP address, eventually the ping replies with the DC1 or DC2 IP address. I have Changed the Priority for DC3, with 2 value, DC1 and DC2 has 0, restart the netlogon service in DC3 but did not work, after a while, when pinging mydomain.local it replies with DC3 IP address. Also I disabled Run Robin in the 3 DC servers with no luck. the result of this command nltest /mydomain.local always gives the DC1 and the DC2 as result, that is OK. the only thing I want, is that when pinging mydomain.local only get replies by my DC1 or DC2. Is this even possible? thankyou for your help

Windows Server 2019
Windows Server 2019
A Microsoft server operating system that supports enterprise-level management updated to data storage.
3,505 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,990 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Dave Patrick 426.2K Reputation points MVP

    Ping is not site aware. Pinging the domain name will just result in one DNS server answering. You could read on here about how domain controllers are located.
    --please don't forget to upvote and Accept as answer if the reply is helpful--

  2. Dave Patrick 426.2K Reputation points MVP

    everytime they ping, the DC3 replies

    As mentioned ping is not site aware so this is not a good test. Something here could help.

    --please don't forget to upvote and Accept as answer if the reply is helpful--