Virtual DC's

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Currently one of our IS directives is to reduce the phyiscal number of
servers by like 30 percent. Our Windows Server Team has greatly expaned the
use of VMWare ESX to virtualize windows servers and are attempting to
virtualize all windows servers in our environment (roughly 300 production
servers with 5500 clients).
Is it a good idea to virtualize Windows Servers that are running Server 2003
and are acting as a Domain Controller? Currently within our 3 production
forest (each containing 2-3 domains) each of the domains has 1 virtual DC.
I'm trying to find justification for keeping most, if not all, domain
controllers to run on physical servers and not to be virtual DC's. The
justification would be needed in order to provide the manager of Windows
Server Team and upper management with information regarding how this can
cause Production outages that could result from having an environment that
has multiple or all virtual DC's.
Additionally, one of the domains has MS Exchange installed in it with
roughly 20,000 users that will have mailboxes once we migrate off of our
legacy email system. In addition we will soon be deploying VAS (Vintela
Authentication Services) into the environment and make use of AD Kerberos for
authentication to Unix Servers and Services.

[Our Enterprise Identity Management Team (my Team) administrates AD, we have
a separate team the Windows Server Team that administrates the server OS, and
a different team that administrates the Exchange servers]

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

"Onion" <Onion@discussions.microsoft.com> wrote in message
news:1B204165-62B8-41E2-A720-CC0B640EDC99@microsoft.com...
> Currently one of our IS directives is to reduce the phyiscal number of
> servers by like 30 percent. Our Windows Server Team has greatly expaned
the
> use of VMWare ESX to virtualize windows servers and are attempting to
> virtualize all windows servers in our environment (roughly 300 production
> servers with 5500 clients).
> Is it a good idea to virtualize Windows Servers that are running Server
2003
> and are acting as a Domain Controller?

They certainly work. There are cases where it is
the "right thing to do."

Small domains (maybe even medium ones) can
run on the same hardware this way.

There are also VPC and Virtual Server groups where
you can ask specific questions (but if it is AD focused
you will want to copy or send to the AD groups).

I see VMWare above, and while VPC and VServer are
not the same product many of the same considerations
apply.

BTW, if there are no bugs, a VM is JUST LIKE a regular
(hardware) machine for practically all network issues.

You have to get name resolution right (DNS and NetBIOS/WIN)
and you have to get routing etc right.

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

You may also want to consider Centrify, www.centrify.com, so you won't have
to extend the AD schema, re-assign UIDs, etc. plus it does more than
authentication (e.g. it has Group Policy built-in).

"Onion" wrote:

In addition we will soon be deploying VAS (Vintela
> Authentication Services) into the environment and make use of AD Kerberos for
> authentication to Unix Servers and Services.
>