Best Practice Methods for Windows 2000 Domain Controller Setup

ID: Q216899

The information in this article applies to:

Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Server

SUMMARY

Before placing Windows 2000 domain controllers and member servers into production, system administrators may want to validate the servers' configuration. This checklist discusses some of the areas to focus on. Some of the topics mentioned require research beyond the scope of this article.

MORE INFORMATION

Review Installation and Boot Process in Event Viewer

Check Event Viewer (Eventvwr.msc) for error and warning messages associated with the installation or boot process. Resolve component and service-related events as required.

Set Event Viewer Log Size and Wrap Setting

Event Log size and log wrapping (overwrite as needed, clear log manually or overwrite after n days) should be defined to match business and security requirements. Consider implementing a system policy at the site, domain or organizational unit level that implements the appropriate configuration.

Review Service Startup

From the Services folder in the Computer Management snap-in, confirm that all services set to Automatic in the Start Up column started without user intervention or multiple retries.

Disable Unnecessary Services

Set the startup value for unnecessary or unused services to Manual. Candidates for review include:

The Print Spooler service for computers not sharing or accessing printers.

DFS and FRS services for computers not hosting or replicating DFS and SYSVOL content.

The messenger and alerter services on all servers.

Consider creating a system policy at the site, domain or organizational unit level that implements the desired service configuration.

Server Service Optimization

Set the Server Optimization setting in the Network tool in Control Panel to match the role the computer will play in your organization, particularly for computers changing roles from domain controllers to member servers if consolidating domains. The Server Service for dedicated Terminal Server or IIS servers should be optimized for "Maximize data throughput for network applications."

Check IP, DNS, WINS and Default Gateway Settings

From the command prompt, type IPCONFIG /ALL to verify correct IP, DNS, WINS, and default gateway configuration. For Windows 2000 servers (particularly domain controllers) that are WINS clients but also running the WINS Server service, both WINS address should point to a remote WINS server to avoid cross-registration.

Run Netdiag to Test Network Connectivity and DNS\WINS Registration

From the command prompt, type netdiag /v >c:\netdiag.mmddyy.txt where mmddyy maps to today's date. Review the text file for good network connectivity and DNS\WINS registration. Save and update this file to a local folder on all servers so it can be reviewed whenever changes are made to the server configuration or network problems are encountered.

View the Fully Qualified Computer Name

From the command prompt, type net config rdr to view the fully qualified computer name. Compare the results against the Active Directory name to confirm they match or vary as intended.

Pagefile Sizing and Staging

Set the pagefile size and placement based on memory size and server usage. Pagefile size may range from RAM SIZE + 12 MB to RAMSIZE * 2. For mission critical servers, a pagefile equal to or larger than RAM size should be placed on the same partition as the operating system to allow crash dumps to be recorded. For better performance, the pagefile can be placed on a dedicated physical drive separate from the drive hosting Windows NT, a hardware drive array, or staged across multiple physical drives where reads and writes occur in "round-robin-like" fashion until available space is consumed. For additional information, please see the following article in the Microsoft Knowledge Base:

Q197379 Configuring Page Files for Optimization and Recovery

Add the /DEBUG Switch to the Boot.ini File to Debug

Add the /DEBUG switch to the Boot.ini file to enable post-mortem debugs of your servers. Adding the debug switch causes a 2-3 percent decrease in server performance but allows a debugger to be hooked up once a crash has occurred for post-mortem debugging. For additional information, please see the following article in the Microsoft Knowledge Base:

Q121543 Setting Up for Remote Debugging

Keep matching symbol files for the core operating system, service packs, and hotfixes on the server at all times.

FSMO Availability and Placement

Windows NT performs an initial placement of roles on domain controllers. This placement is often correct for directories with few domain controllers. In a directory with many domain controllers the default placement is unlikely to be the best match to your network. A discussion on DFSMO role placement is beyond the scope of this document but as a general rule:

The schema master and domain naming master roles should be placed on the same domain controller as they are rarely used and should be tightly controlled.

The infrastructure master should not be located on the same domain controller holding the RID master and PDC emulator roles if it is also a GC server. Most importantly, confirm that all FSMO roles are available using one of the management consoles (such as Dsa.msc or Ntdsutil.exe).

Perform a Backup of the DS and Key Services

Use the Windows 2000 Backup Automated System Recovery option or equivalent to back up the system. Develop and maintain a backup process for the directory service and all critical services.

Practice restorations of the entire computer as well as authoritative and non-authoritative restorations of the DS and individual services in a lab environment that emulates your production network infrastructure in terms of speed, capacity, and hardware.

EFS Recovery Policy

Develop a plan for storage and recovery of Encrypted File System (EFS) certificates that take into consideration security and personnel access at the times they will likely be needed. Servers are typically rebuilt during an off-peak hour some 6-36 months after the original deployment).

Additional query words:

Keywords : ntdomain
Version : WINDOWS:2000
Platform : WINDOWS
Issue type : kbinfo