A DHCP Server or a Certificate Authority roles installed on your Domain Controllers will enforce you to deal with them first, and only then move forward and upgrade the Active Directory itself. Upgrading your Active Directory environment becomes a much more complicated task.

This, in fact, creates a dependency between ADDS and other roles and affect the redundancy of the Active Directory Domain Services. If any of these Domain Controllers will be turned off or get damaged, its roles and features might be affected and become unavailable. Domain Controllers with additional roles and features become unique and different compares to other Domain Controllers.

When you install additional roles and applications on your Domain Controllers, two problems are raised: There is a wide variety of roles and applications which administrators install on the Domain Controllers, but there is one thing common to all of them: Domain Controllers are NOT the place for them.īy default, any Domain Controller in a domain provides the same functionality and features as the others, what makes the Active Directory Domain Services not be affected if one Domain Controller becomes unavailable.Įven in a case where the Domain Controller holding the FSMO roles becomes unavailable, the Domain Services will continue to work as expected for most scenarios (at least in the short-term). Beside Windows Server roles, I also find special applications and features running on the Domain Controllers, like KMS (Key Management Service) host for volume activation, or Azure AD Connect for integrating on-premises directories with Azure AD. This can be any role – from RDS Licensing, through Certificate Authority and up to DHCP Server. When I review a customer’s Active Directory environment, I often find additional Windows Server roles (other than the default ADDS and DNS roles) installed on one or more of the Domain Controllers. Mistake #7: Installing Additional Server Roles and Applications on a Domain Controller we’ll go on and review three additional mistakes and summarize this series. The 3’rd part of the series is no exception. In the previous parts, we covered some major mistake like configuring multiple password policies using GPO and keeping FFL/DFL at a lower version. This blog post is the third (and last) part in the ‘Most Common Mistakes in Active Directory In Domain Services” series.

Ad ds windows server 2019