Is it advisable to use a domain controller as the witness server for the Database Availability Group in Exchange Server?

Question

We have on-premise exchange server setup in windows server 2019 standard environment. Two for primary site and two for DR site with one Witness server (Domain Controller). Is it recommended to use DC as DAG witness or not. If not, how does it impact. Kindly share the recommended architecture for the witness server. Thank you

Answer 1

Its not, you should use a small sized server. Why? Because if you have to do any troubleshooting, avoid the need to mess with a DC.

It also means adding the Exchange Trusted SubSystem group to the DC:

https://support.microsoft.com/en-us/topic/the-exchange-server-is-not-a-member-of-exchange-trusted-subsystem-2c4d47c7-d5a2-8976-c059-132b43104fd2

So, all in all, not recommended for mgmt and security reasons.

Answer 2

Hi @Narayan Das Kohli ,

Welcome to the Microsoft Q&A platform!

Microsoft generally does not recommend using a domain controller (DC) as a database availability group (DAG) witness server. Here are the reasons and recommended architectures:

Why not use a DC as a DAG witness server?

1. The witness server should be a minimal role server to reduce the attack surface. DCs have broader roles and run more services, which increases risk.
2. The additional load on the DC affects its primary function, which can affect the overall performance of the network.
3. Combining roles makes troubleshooting more complex and time-consuming.

Recommended architecture for a witness server :

1. Ideally, the witness server should be a dedicated server that does not perform any other roles. This minimizes security risks and simplifies management.
2. If possible, place the witness server in a third site. This helps ensure that the witness server is available even if one of the primary sites fails.
3. Make sure the witness server is configured with the necessary permissions and belongs to the same Active Directory domain as the DAG members.

For detailed guidance on setting up a DAG and preferred architecture, you can refer to Microsoft's Exchange 2019 preferred architecture.

---

Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer.

Best,

Jake Zhang