"ken444444" <k e n -a t- k en bl ai r *-d_o_t-* c0m> wrote in message
news:1C1B4670-8868-4910-A6CC-4A13D1E2F5DB@microsoft.com...
>I have an existing 6 site Windows 2000 AD installation for about 125 users.
> It will be upgraded to Windows 2003 AD.  Currently, the infrastructure is
> strung together with no logic about which servers run DNS or what DNS
> servers
> each domain controller looks to for DNS.  I can't believe it all works.
>
> I would like to streamline the infrastructure when the 2003 upgrade
> happens.
> There are two major sites containing most of the users (50 users each) .
> These sites each have 3 DCs.  The other sites have one DC.   After the
> 2003
> upgrade, should each site's DC also run DNS?  Or should I only run DNS out
> of
> the major two sites and have the remote sites get DNS from the major
> sites?
> All sites are in different countries around the globe and are connected
> via
> VPN.  The more distant sites' connections can be pretty flakey at times
> and I
> don't trust them to be up 100%.

"Cary Shultz" wrote:

> Ken,
>
> It is good to have redundancy.
>
> However, for 50 users in each of the two 'big' sites it might be a bit
> overkill to have three Domain Controllers.  Two should suffice. You could
> even get away with one Domain Controller in each of the 'big' sites.
>
> And in each of the other four sites I might have just one DC, especially
> given the flaky connection via the VPN.  You definitely want the users to be
> able to authenticate against a 'local' Domain Controller.  Is this currently
> happening?  Although you probably have set up Active Directory Sites and
> Services correctly (each Site would be created and a subnet would be created
> for each Site and then associated with the correct Site) it is still
> possible that the users are authenticating against a 'remote' Domain
> Controller.  This is sometimes a problem in WIN2000.  There are ways to
> avoid this (er, better said is to reduce this).
>
> I would possibly run DDNS on each Domain Controller.
>
> The 'Branch Management' in WIN2003 is really improved over that of WIN2000.
> I am just getting into WIN2003 (I know, a bit late) but have read and heard
> that there are some nice improvements in this area.  I would suggest that
> you read the WIN2003 Branch Management White Paper.
>
> --
> Cary W. Shultz
> Roanoke, VA  24012
>
> "ken444444" <k e n -a t- k en bl ai r *-d_o_t-* c0m> wrote in message
> news:1C1B4670-8868-4910-A6CC-4A13D1E2F5DB@microsoft.com...
> >I have an existing 6 site Windows 2000 AD installation for about 125 users.
> > It will be upgraded to Windows 2003 AD.  Currently, the infrastructure is
> > strung together with no logic about which servers run DNS or what DNS
> > servers
> > each domain controller looks to for DNS.  I can't believe it all works.
> >
> > I would like to streamline the infrastructure when the 2003 upgrade
> > happens.
> > There are two major sites containing most of the users (50 users each) .
> > These sites each have 3 DCs.  The other sites have one DC.   After the
> > 2003
> > upgrade, should each site's DC also run DNS?  Or should I only run DNS out
> > of
> > the major two sites and have the remote sites get DNS from the major
> > sites?
> > All sites are in different countries around the globe and are connected
> > via
> > VPN.  The more distant sites' connections can be pretty flakey at times
> > and I
> > don't trust them to be up 100%.
>
>
>

"Paul Williams [MVP]" wrote:

> Use AD-Integrated DNS.  This way every DC is a DNS server if you have DNS
> installed.  So, install DNS on all servers.
>
> At the main site, point clients to both DCs for DNS.
> At the remote sites, point clients to the local DC and the two in the
> central site for DNS.
>
> --
> Paul Williams
> Microsoft MVP - Windows Server - Directory Services
> http://www.msresource.net | http://forums.msresource.net
>
>
>