Home / server / Questions / 526763
Accepted
PnP
Asked: 2013-07-28 10:02:10 +0800 CST

Do you need a GC online to DCPromo?

  • 772

We've inherited a customer who after auditing their site turns out they used to have a site-to-site VPN and another DC at the endpoint (which was the only GC in the forest). THe previous IT company demoted this, cleaned up AD, but never made their now main DC a GC.

We want to replace their current DC (2003) with a 2008R2 box, is it best to make the current DC a GC first then dcpromo the new DC, or does it not matter? Bare in mind the new DC will be made a GC.

active-directory

1 Answers

  1. Best Answer

    I would recommend (and so does Microsoft) that you make all domain controllers global catalogs unless you have a very good reason not to.

    You need network access to the RID Master FSMO role holder for the domain before you can promote a writable domain controller. Otherwise, only an RODC could be created, which I'm guessing is not what you want.

    But to answer your question more directly, a domain controller does not need a global catalog to be promoted into an existing domain.

    Edit: I have verified via lab testing that I was able to promote a new domain controller into an existing domain with the bare minimum of a non-GC domain controller online that was hosting the RID FSMO. The other 4 FSMOs were down and no global catalog was up.

    Here's some more info from the fantastic AskDS blog about other reasons you will want a global catalog online, even in a single-domain forest:

    Question

    If I have only one domain in my forest, do I need a Global Catalog? Plenty of documents imply this is the case.

    Answer

    All those documents saying "multi-domain only" are mistaken. You need GCs - even in a single-domain forest - for the following:

    • Perversely, if you have enabled IgnoreGCFailures (http://support.microsoft.com/kb/241789); turning it on removes universal groups from the user security token if there is no GC, meaning they will logon but not be able to access resources they accessed fine previously).

    • If your users logon with UPNs and try to change their password (they can still logon in a single domain forest with UPN or NetBiosDomain\SamAccountName style logons).

    • Even if you use Universal Group Membership Caching to avoid the need for a GC in a site, that DC needs a GC to update the cache.

    • MS Exchange is deployed (All versions of Exchange services won't even start without a GC).

    • Using the built-in Find in the shell to search AD for published shares, published DFS links, published printers, or any object picker dialog that provides option "entire directory" will fail.

    • DPM agent installation will fail.

    • AD Web Services (aka AD Management Gateway) will fail.

    • CRM searches will fail.

    • Probably other third parties of which I'm not aware.

    • 10