DC as a terminal server question.

[hennessyk]

Site #1 has a 2000 server that holds all the roles for the domain.
There is a persistent VPN to....
Site #2 where another DC is (2003 server). The Secondary DC is also a Global Catalog server. Universal group caching is also enabled at this site.

Here is where it gets tricky: The Second DC is being used as a terminal server (not my idea, I know it's a bad, bad idea). The problem is when the VPN goes down, the users can't login to the Terminal Server/DC at site #2. They get no domain is available error when trying to terminal in.

Is there a way for the users to login to a terminal/DC when no roles are present?

 

[Davetoo]

No, there is nothing to authenticate them to the network.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

 

[pagy]

No, there is nothing to authenticate them to the network

I would have thought the DC at the 2nd site should authenticate them. Which server is the terminal server licence server??

Server should be a GC or have universal group caching, choose one or the other.

Paul
MCSE


"Two things are infinite: the universe and human stupidity; and I'm not sure about the the universe."
Albert Einstein

 

[Davetoo]

If the VPN is down, the connection to the other server which could authenticate them is gone.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

 

[pagy]

Maybe I'm not understanding properly but it reads to me like one domain with a DC in site 1 and site 2. The DC in site 2 is also used as a terminal server by users in site 2.

If that is the case then users in site 2 should still be able to authenticate using the DC in at their site despite the VPN going down.

Or am I reading the problem incorrectly??

Paul
MCSE


"Two things are infinite: the universe and human stupidity; and I'm not sure about the the universe."
Albert Einstein

 

[Davetoo]

Oh, yeah, I guess I didn't read that close enough...if the VPN were down users at site 1 wouldn't even be able to connect to get the error. My bad.

Is this all one domain between site 1 and site 2?

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

 

[Roadki11]

Yes they should be able to authenticate to site 2's DC if its configured correctly. Site 2's DC should be a 2nd GC it should also have DNS setup and that sites clients should be pointing to it as a primary DNS server or at least as the secondary DNS server on the clients(im guessing this is the problem). You should also have Sites and Services configured with 2 sites with the DC's in the correct Site container and dont forget to configure subnets.

RoadKi11

 

[pagy]

hennessyk,

More about sites and services if you require;

http://www.microsoft.com/technet/pr...rectory/activedirectory/stepbystep/adsrv.mspx

Paul
MCSE


"Two things are infinite: the universe and human stupidity; and I'm not sure about the the universe."
Albert Einstein