Azure VM, Active Directory and a Dedicated Disk

Installing the AD DS role onto a Azure virtual machine? Creating a Domain Controller in the cloud? Are you sure you want to do this?

For all Domain Controllers you create on an Azure virtual machine, in addition to the system OS disk (C:\) you MUST add a dedicated disk and ensure thatyour AD DS install wizard or script uses this dedicated disk as the location for both the Active Directory database (NTDS) and the replicated system volume (SYSVOL) during the Role installation.

IMPORTANT: For this dedicated disk ensure that the ‘Azure Disk Host Cache’ is set to NONE

Failure to do this risks the corruption of your Active Directory database.

The relevant Microsoft documentation can be found here https://msdn.microsoft.com/en-us/library/azure/jj156090.aspx?f=255&MSPPError=-2147217396

I’ve extracted the exact section below, saves you going through the whole web page above:

“Data disk drives do not cache writes by default. Data disk drives that are attached to a VM use write-through caching. Write-through caching makes sure the write is committed to durable Azure storage before the transaction is complete from the perspective of the VM’s operating system. It provides durability, at the expense of slightly slower writes.

This is important for Windows Server AD DS because write-behind disk-caching invalidates assumptions made by the DC. Windows Server AD DS attempts to disable write caching but it is up to the disk IO system to honor it. Failure to disable write caching may, under certain circumstances, introduce USN rollback resulting in lingering objects and other problems.

As a best practice for virtual DCs, do the following:

  • Set the Host Cache Preference setting on the Azure data disk for NONE. This prevents issues with write caching for AD DS operations.
  • Store the database, logs, and SYSVOL on the either same data disk or separate data disks. Typically, this is a separate disk from the disk used for the operating system itself. The key takeaway is that the Windows Server AD DS database and SYSVOL must not be stored on an Azure Operating System disk type. By default, the AD DS installation process installs these components in %systemroot% folder, which is NOT recommended for Azure.”
Tags: , , , , , , , , ,

Migration Guide: FRS to DFS Replication

In an effort to reduce SYSVOL bloat and replication across Domain Controllers (DCs) consider using DFS Replication (DFSR). A bigger reason however is that FRS is no longer supported in Server 2012, so if you plan to upgrade DCs to Server 2012 – then you must do this first. Want a third reason? If you are using Read Only DCs (RODCs) and are still on FRS it is easy for the SYSVOL on the RODC to become out of synch with other DCs; better still in Server 2008 R2 and above DFS-R ensures that the RODC SYSVOL can never be modifed.

DFS-R simply provides better and more efficient synchronisation than the old world File Replication Service (FRS). Prior to proceeding you may want to indeed check  and make sure that you are not already using DFS-R. Jump into a command prompt and type in this command:

Dfsrmig /GetGlobalState

If the output is shown as “Current DFSR global state: ‘Eliminated’” then you are already using DFS-R and there is no need to go any further. Stop right here.

dfsrmig command
dfsrmig command
Did You Know: the DFS-R migration process actually uses Robocopy (yes! Robocopy) to copy the SYSVOL data at various stages


All Domain Controllers need to be online and available. If you have any redundant DCs listed and they have not been cleaned up (meta data an’ all!) then do so before starting this task

Depending on what Server OS and Service Pack Level you are on ALL DCs may need to be located in the default Domain Controllers OU. If they are located in a sub OU or elsewhere (for policy reasons usually) then consider moving them into the default location temporarily during the migration

The PDC Emulator MUST be online during the whole process – that’s the dude with the most up to date Policy and it is the DC that this whole process talks to the most

You need at least a Windows 2008 Functional Level for your Domain, so get rid of those soon to be end of life Server 2003 R2 DCs first

4 Steps to DFS-R

There are 4 steps to migrate from FRS to DFS-R using the Dfsrmig command:

  1. Health Check: Run the following commands to check the health of current replication
    1. Ensure there is enough free disk space on each Domain Controller for the migration
    2. Run repadmin /replsummary to ensure current replication is healthy, resolve any issues
    3. Run repadmin /showrepl * /csv > replication.txt to ensure current replication is healthy, resolve any issues in the output file
  2. Migrate to Prepared State: Use the command Dfsrmig /SetGlobalState 1 to begin the migration, use Dfsrmig /GetMigrationState to check the current status of this step. Do NOT proceed until this step is complete
  3. Migrate to Redirected State: Use the command Dfsrmig /SetGlobalState 2 for this second step, use Dfsrmig /GetMigrationState to check the current status of this step. Do NOT proceed until this step is complete. If you wish to stay with FRS for SYSVOL replication then stop here.
  4. Migrate to Eliminated State: [NOTE: There is no going back after this step! You have been warned] Use the command Dfsrmig /SetGlobalState 3 for this final step, use Dfsrmig /GetMigrationState to check the current status of this step. Once this step is complete so is the migration.

That’s all there is too it. Honest.

If you did execute Step 4 in error, then as I said there is no going back. Ever. Except of course unless you rebuild the whole domain (a whole lot of fun for you then!).

Clean Up Tasks – get rid of FRS!

Now that you have succesfully migrated to DFS-R you now need to

  • Delete the old SYSVOL directory
  • Disable and then Remove the NTFRS Service

You really should download and read the full Microsoft guide found here: http://technet.microsoft.com/en-us/library/dd640019(WS.10).aspx

As usual, get in touch if you have any questions.

Tags: , , , , , , , , , , , , , , , ,
%d bloggers like this: