load balance for AD Controllers

[cci admin]

Hello people!

I am wondering if anyone came accross trying to create load balance between
to GC AD Domain controllers in one site for accepting logons.

I have changed settings in DNS server - domain - for every account of SRV
records to have high weight and 0 priority for one of the servers and low
weight and 100 priority for the other slower server. But still, clients
randomly logon to any of the servers, sometimes even more to the slower
domain controller.

Are those settings getting ignored if both domain controllers are in one
site? Or does it all depend on network distance too?

Thanks!

 

[Michael Schipp]

I think you will find that MS DNS uses round robbin - so it will not do what
you wish it to

 

[cci admin]

Wow, so Microsoft have not made a solution for that?
I'm sure there are many like me stuck in same situation with an old DC that
they just want to keep for backup logons instead faster one dies.

No hacks or tweaks anyone thought of?
I've tried to delete the slower controller's SRV records from
default-first-site but no change, actualy it's weird, most workstations
unfortunately logon using the slower Domain controller for some reason.

My question is:
What are those Priorities and Weights for? Do they have any purpose
whatsoever? Because if you read from MS Help file, they are designed to
provide preferences to computers providing this service.

I might want to add, there are a lot of things i have found in MS products
that just don't work like they are documented, and some things don't work at
all, specially ntbackup when any other third party tool works. And any time
i got Microsoft support so far has never resolved any issue i had,


Assuming that you are right about this, I might just roll back to using
Samba for domains where everything did work like it was meant to, i think i
may be getting tired of these Microsoft headaches.

Thanks

I think you will find that MS DNS uses round robbin - so it will not do what
you wish it to

 

[Cary Shultz [A.D. MVP]]

Correct - sorta!

Out of the box you will notice that the priority and weight are set to [0]
and [100], respectively. In this case, since all records have an equal
value priority of [0] and an equal value weight of [100] all DCs are equal
and a round robin 'effect' is noticed.

However, I might suggest that if you were to keep the priority set at [0]
for the more powerful, desired DC and increase the priority on the other DC
to anything higher ( like, [25] for example ) then all of your clients would
authenticate against the DC with the priority of [0]. The only time that
any client would authenticate against the DC with the priority set to [25]
would be when the DC with the priority set to [0] was not available - aka,
does not respond within 100ms. This is also probably not what you want - as
you mention load balance.....

I might now suggest that instead of changing the priority ( because clients
are to first attempt to connect to the DC with the lowest priority ) you
look at the weight. If you want the more powerful DC to authenticate 4x as
many requests as the less powerful DC then I might suggest that you set the
weight to [80] and [20], respectively. If you want the more powerful DC to
authenticate 1.5x as many requests then I might suggest that you set the
weight to [60] and [40], respectively.

HTH,

Cary

I think you will find that MS DNS uses round robbin - so it will not do what
you wish it to

 

[Cary Shultz [A.D. MVP]]

CCI Admin,

I might disagree with your comments about things not working the way they
are documented. I find that MS is taking some very important steps forward
in making sure that the products that they are releasing are as bug-free as
possible and as secure as possible. Is this always going to be the case?
No! There will always be someone out there who will put forth a lot of
effort to find away around something. Unfortunately ( and at the same
token, fortunately ) there will always be someone doing this.

Are there a lot of 'features' in the MS products? Yes. Do all products
work the same way? No. Do all products do what they are hyped to do?
Well, usually! But that is more of a Marketing / Sales thing. I have been
on both sides of that fence. The guys in Sales promise the impossible and
the tech guys are supposed to deliver!

I typically find that when someone can not 'get something to work' it is
typically because that someone is not completely familiar with the product
or how it works. Enter the Internet. With google and, in this case, both
the Microsoft web site and the News Groups there is almost no reason why a
solution can not be found. What I do not know you might and what you do not
know I might. This is the beauty of this community. No one can know it
all, especially in this industry. However, knowing where to look for an
answer is probably one of the top two or three things to know in this
industry. You did not know how to do something or how something works.
That is okay. You did the right thing. You posted your situation to a
community news group. Unfortunately, the person who responded was not
entirely accurate. Partially accurate, yes. But not entirely. So I
answered. And only God knows how many others might answer with even more
detailed information.

I would suggest to you that you also take a look at the following two MSKB
Articles:

http://support.microsoft.com/?id=247811
http://support.microsoft.com/?id=314861

These two articles describe - in detail, how WIN2000 ( 247811 ) and WIN XP
( 314861 ) clients locate Domain Controllers.

I might suggest that you are more familiar with SAMBA than with Microsoft.
That could account for the headaches! I know that if I had to go into a
Novell or Linux environment I would have migraines!

HTH,

Cary

Wow, so Microsoft have not made a solution for that?
I'm sure there are many like me stuck in same situation with an old DC that
they just want to keep for backup logons instead faster one dies.

No hacks or tweaks anyone thought of?
I've tried to delete the slower controller's SRV records from
default-first-site but no change, actualy it's weird, most workstations
unfortunately logon using the slower Domain controller for some reason.

My question is:
What are those Priorities and Weights for? Do they have any purpose
whatsoever? Because if you read from MS Help file, they are designed to
provide preferences to computers providing this service.

I might want to add, there are a lot of things i have found in MS products
that just don't work like they are documented, and some things don't work at
all, specially ntbackup when any other third party tool works. And any time
i got Microsoft support so far has never resolved any issue i had,


Assuming that you are right about this, I might just roll back to using
Samba for domains where everything did work like it was meant to, i think i
may be getting tired of these Microsoft headaches.

Thanks

 

[cci admin]

Thanks Cary,
thanks indeed for your help, article link you posted is great.
In fact, me as well as Microsoft owe it to you for giving your spare time
and effort to help others.


What i am about to say is NOT in any way addressed to any of the people on
internet newsgroups or other helpful communities. I may be incorrect about
some of the things i will say but,

About my problem
In my case, it just simply does not work as it says it has to work, i am
sorry but if something doesn't work it just doesn't work and I did exactly
what you said when assigning 0 priority to preferred DC and a higher
priority to non-preferred DC, and weight was well.

I may have offended some Microsoft enthusiasts here, however..
The reason for my concern is I have paid big money for this software and
main purpose for it was to ease my tasks, I have been confirmed and
reassured that this is a perfect product for Redundancy, i rang Microsoft to
make sure it has DFS Instant redunadcy features before i bought the
products, and easiest to administer a domain. Don't get me wrong, i am an
MCP in server as well but I just do not see the logic behind how some things
work in Microsoft products. I still don't.

We don't pay $1500AUD and then another $10,000 for client licenses to get a
product where to get many of the things working like they should we
apparently need tweaks that go far beyond numerous registry changes and
other tricks that Microsoft refuses to assure they won't cause damage. I did
not buy this software for home use, our company now depends on it. See, the
big problem with Microsoft is that these kind of things often just don't get
resolved.. And I am afraid it is another one of those issues right here. I
have posted similar problem before about DFS redundancy along with few other
people with the same problem where Windows Servers have unpredictable effect
whether to update their DNS settings or not, i have tried MS tech support, i
had the same outcome. No solution. Right now, i think i might just try and
sell it back to Microsoft guy who was assuring me of those things.

I had numerous issues with many things that Microsoft tech support never
really resolved for me, all they ever did was collect log file from a
program they gave me, the a week later they would apologise and tell me it
is most likely some third party element that has damaged or made MS product
not work like it should, specially with their ntbackup software, weird
problems with user accounts having not being able to load roaming profile
with security logs saying not enough access rights when even ms guy
scratched his head and said it should act like this.. i could list you so
many things i had but my head is starting to spin when i try and keep track
of the number of problems. And i know it is definantely not only me.

I am not complaining that MS Server is a shit software, in fact its good,
but I think that when a company SELLS a product, they damn better make sure
it works and it is documented. People pay big money because they want to be
assured the product is going to work and not worry about waiting for months
before an answer to their problem can be found on the internet just because
MS tech support is helpless on the issue. Or if they are not prepared for
that, they should just make it a freeware until it is a finished product.
Look at a perfect example, Cisco. Even though noone would ever come close to
being a competitor, they do care about their customers and importantly -
make sure they have configuration available for any situation, look at the
amount of documentation available, various fixes, various examples. Even
when you call presales team, these guys will tell you anything about the
product right and they know what they are talking about. Many companies.

I am sorry if my comments are so blunt and angry, but I hope you can
understand my frustration over a year period of using Windoze Servers in a
"real" work enviroment.

Thanks

Correct - sorta!

Out of the box you will notice that the priority and weight are set to [0]
and [100], respectively. In this case, since all records have an equal
value priority of [0] and an equal value weight of [100] all DCs are equal
and a round robin 'effect' is noticed.

However, I might suggest that if you were to keep the priority set at [0]
for the more powerful, desired DC and increase the priority on the other DC
to anything higher ( like, [25] for example ) then all of your clients would
authenticate against the DC with the priority of [0]. The only time that
any client would authenticate against the DC with the priority set to [25]
would be when the DC with the priority set to [0] was not available - aka,
does not respond within 100ms. This is also probably not what you want - as
you mention load balance.....

I might now suggest that instead of changing the priority ( because clients
are to first attempt to connect to the DC with the lowest priority ) you
look at the weight. If you want the more powerful DC to authenticate 4x as
many requests as the less powerful DC then I might suggest that you set the
weight to [80] and [20], respectively. If you want the more powerful DC to
authenticate 1.5x as many requests then I might suggest that you set the
weight to [60] and [40], respectively.

HTH,

Cary