The primary domain controller is faulty, and the secondary domain controller cannot immediately replace the primary domain controller?

Question

The primary domain controller is faulty, and the secondary domain controller cannot immediately replace the primary domain controller?

yz 0

Hello everyone, I would like to ask you, the primary domain controller is bad, why can't the secondary domain controller replace it immediately? Our company uses windows 2016 server to do the primary and secondary domain control, and there is synchronization. A God domain controller suddenly crashes, but the secondary domain controller can not top, how to do so that the secondary domain controller can immediately top? At present, if you want to use the secondary domain controller, you can only switch over when the primary domain controller is normal, but no one will know in advance when the primary domain controller is bad.

1 answer

Your answer

Answer 1

Thameur-BOURBITA 36,261 Moderator

Hi @yz•

If the primary DC is crashed and you are unable to restore it , in this case you should launch metadata cleanup to remove from Active Directory and it hosts fsmo roles you have to seize them to move them to secondary DC.

https://blog.netwrix.com/2023/12/08/seize-fsmo-roles/

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/ad-ds-metadata-cleanup

if member machines are using the primary DC as dns resolver you have to switch to secondary DC.

Please don’t forget to accept helpful answer

Anonymous

2024-02-05T03:29:40.5266667+00:00

Hello yz,

Thank you for posting in Q&A forum.

I would like to ask you, the primary domain controller is bad, why can't the secondary domain controller replace it immediately?
A: As I understand, you have only two DCs (one primary one and the secondary one).

If an Operation Master role holder experiences a failure or is otherwise taken out of service before its roles are transferred, you must seize and transfer all roles to an appropriate and healthy DC.

Now the primary DC crashed, if it is the PDC software issue and the machine can be open and running, you can transfer the FSMO roles to the secondary DC.

After the previous PDC software issue fixed, you can transfer the FSMO roles to it again if needed.

If it is the hardware issue, and the machine will not be fixed and the PDC will never be online and running later, you can seize the FSMO roles to the secondary DC.

Note:

1.We recommend that you only seize all roles when the previous role holder isn't returning to the domain.
2.If it's possible, and if you're able to transfer the roles instead of seizing them, fix the previous role holder. If you can't fix the previous role holder, or if you seized the roles, remove the previous role holder from the domain.

3.If you seize the FSMO roles and remove the previous DC from domain and if you plan to use the repaired computer as a DC, we recommend that you rebuild the computer into a DC from scratch instead of restoring the DC from a backup. The restoration process rebuilds the DC as a role holder again.

If it is the hardware issue, and the machine will not be fixed and the PDC will never be online and running later, you can seize the FSMO roles to the secondary DC. Please remember:

Update the DNS client configuration on all member workstations, member servers, and other DCs that might have used this DNS server for name resolution. If it is required, modify the DHCP scope to reflect the removal of the DNS server.

Update the Forwarder settings and the Delegation settings on any other DNS servers that might have pointed to the removed DC for name resolution. Transfer or seize Operation Master roles in Active Directory Domain Services

https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/transfer-or-seize-operation-master-roles-in-ad-ds

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know. Best Regards, Daisy Zhou

If the Answer is helpful, please click "Accept Answer" and upvote it.

Share via

The primary domain controller is faulty, and the secondary domain controller cannot immediately replace the primary domain controller?

1 answer

If you have any questions or concerns, please feel free to let us know. Best Regards, Daisy Zhou

Your answer