Mixed Mode and GC's

[Guest]

Someone told me in a native mode AD domain, if a wan link fails at a site
with no gc, users will not be able to authenticate and logon, however if the
AD domain was in mixed mode and the wan link failed users WOULD be able to
authenticate and logon? this does not make sense to me can anyone explain -
the site has a dc and the AD domain contains no nt domain controllers. thanks
in advance.

 

[Matjaz Ladava [MVP]]

This is because in mixed mode domain there is no universal groups, which are
stored in gc's. that is why during logon in native mode domain gc's are
contacted to process universal group membership. Also gc's are used if you
use UPN logon.

--
Regards

Matjaz Ladava, ladava.com
MCSA, MCSE, MCT
Microsoft MVP Windows Server - Directory Services
e-mail: (e-mail address removed), (e-mail address removed)

 

[Joe Richards [MVP]]

You can force DCs to still process the auth in absence of a GC in native mode by
setting ignoregcfailures in the registry on the DC. However if you do this DO
NOT USE UNIVERSAL GROUPS for DENY. I wouldn't recommend it for GRANTS as well.

joe

 

[Herb Martin]

Someone told me in a native mode AD domain, if a wan link fails at a site
with no gc, users will not be able to authenticate and logon, however if the
AD domain was in mixed mode and the wan link failed users WOULD be able to
authenticate and logon? this does not make sense to me can anyone explain -
the site has a dc and the AD domain contains no nt domain controllers. thanks
in advance.

The other responders have pretty much answered your question.

In Native mode (non-Admin) users will be blocked
from logging on if not GC is reachable.

Admin can logon to FIX the problem despite this.

A setting (Joe's message) can override this behavior.

You really should have a least one RELIABLE GC
per site -- if fault tolerance is necessary for your
users' access to domain resources you may need more.

If you are functioning in Mixed mode then the odds are
very good that your forest is small and so it may be
quite practical to have every DC be a GC.

There is no disadvantage to having every DC be GC
in a single domain forest.
[/QUOTE]