Domain controller management for small offices

What a domain controller does

A domain controller is a Windows server running Active Directory. Think of it as the office's front desk and register. It holds the list of every user and computer, checks passwords when people sign in, decides who can open which shared folder, and pushes out settings such as password rules and mapped drives.

It usually also runs DNS, which is how computers on your network find each other and the internet. If DNS on the domain controller stops, even things that seem unrelated, like opening websites or connecting to the printer, can fail.

Why two domain controllers

With only one domain controller, it is a single point of failure. If its disk dies, its power supply fails or it is damaged in a power surge, the whole office stops until it is repaired or rebuilt, and rebuilding Active Directory from scratch is slow and painful.

With two, they share the work and copy changes to each other. If one fails, the other keeps everyone signed in while you fix the first. The second one does not need to be expensive. It can be a modest server or a virtual machine on separate hardware. What matters is that it does not share the same single disk, power supply or host as the first.

Replication: the silent failure

Two domain controllers keep each other up to date through replication. A new user, a password change or a new group membership on one is copied to the other, usually within minutes.

The danger is that replication can stop without anyone noticing. Staff can still sign in, because each server answers on its own. But the two copies drift apart. A password changed on one does not reach the other. A leaver disabled on one is still active on the other. After a long enough gap, Windows may refuse to let them sync at all, and one has to be removed and rebuilt carefully.

It is not unusual to find domain controllers that quietly stopped replicating months ago. Everything looked fine until one server failed and the survivor turned out to be badly out of date. A simple check would have caught it early. Ask your IT provider to run a replication health check and show you the result, and to set up monitoring that warns when replication fails.

Time must be right

Active Directory depends on accurate time. If a computer's clock is too far from the domain controller's, sign-in can fail with confusing errors. The domain controller holding a special role (the PDC emulator) should get its time from a reliable external source, and every other computer should get time from the domain. After power cuts, check that the server clocks are still correct.

Back up Active Directory properly

Copying files off a domain controller is not enough. Active Directory needs a system state or full server backup made with tools that understand it. Keep these backups for long enough to recover from a mistake you notice late, and test a restore occasionally in an isolated environment. A second domain controller protects against hardware failure, but not against someone deleting half your users by accident or ransomware spreading to both.

Admin accounts and patching

The domain administrator account can do anything, which makes it the first thing attackers look for. Keep the number of people with domain admin rights small. Give them separate admin accounts used only for admin work, never for email or browsing. Use long, unique passwords, and remove access immediately when someone leaves or a contractor finishes.

Domain controllers need monthly security updates like any other server. Schedule them out of hours, update one domain controller at a time, and check it comes back healthy before doing the next.

Monitoring

Basic monitoring should tell someone when a domain controller is offline, when its disk is nearly full, when replication fails, when backups fail, and when there are unusual sign-in failures or new admin accounts. Alerts should go to a person who will act, not to an inbox nobody reads.

Questions to ask your IT provider

You do not need to run these checks yourself. Ask for the answers.

• How many domain controllers do we have, and on separate hardware?
• When was replication last checked, and was it healthy?
• Is time on the servers correct and from a reliable source?
• Is there a system state backup, and when was a restore last tested?
• Who has domain admin rights, and do they use separate admin accounts?
• Are the domain controllers patched every month?
• What monitoring is in place, and who receives the alerts?

Dalysie Ghana can check the health of your domain controllers, fix replication and set up monitoring so problems are caught early.