Group Policy points to wrong DC

[scottalanmiller]

@Obsolesce said in Group Policy points to wrong DC:

First of all, you need to have sites properly set up if you have more than one DC.

Not if you only have a single site

[G I Jones]

Your client devices will use the DC that is in their same site, and if there's more than one DC in it's site, the best DC will be chosen... which leads to the second point.

I guess what I was playing at was how I could trick the process of "the best DC will be chosen". I figured if I moved the secondary to another site, then it would default to the one I wanted it to, but I got two things wrong: first and most important, I can just manage Group Policy on the secondary and there wouldn't be a wait, and two, I don't have a full understanding of how Windows picks the "best DC". Is it hops? Is it strictly Subnet? Maybe I'll look into that at some point. For now I'll consider this issue solved.

[G I Jones]

@Obsolesce said in Group Policy points to wrong DC:

Secondly, there are no "Backup DCs". It's not something you use like that, and it really makes sense why. It's a HA system by design, think CDN style if you see what I mean.

Thanks for the heads up on the terminology. :raised_fist_medium-light_skin_tone:

[scottalanmiller]

@G-I-Jones said in Group Policy points to wrong DC:

Your client devices will use the DC that is in their same site, and if there's more than one DC in it's site, the best DC will be chosen... which leads to the second point.

I guess what I was playing at was how I could trick the process of "the best DC will be chosen".

So if this is just an exercise in learning. Great. If not, let's back up. Why do you want to do this? What makes you feel one is better than another?

[G I Jones]

@scottalanmiller said in Group Policy points to wrong DC:

@G-I-Jones said in Group Policy points to wrong DC:

Your client devices will use the DC that is in their same site, and if there's more than one DC in it's site, the best DC will be chosen... which leads to the second point.

I guess what I was playing at was how I could trick the process of "the best DC will be chosen".

So if this is just an exercise in learning. Great. If not, let's back up. Why do you want to do this? What makes you feel one is better than another?

It really only boiled down to I don't want to wait 15 minutes (the minimum replication between DC's) for a GPO to apply.

[Dashrender]

@G-I-Jones said in Group Policy points to wrong DC:

e secondary to another site, then it would default to the one I wanted it to, but I got two things wrong: first and most i

As I recall - it's either which ever DC is provided by DNS when a query for a DC is given, OR in the case of broadcast - whomever answers first.

On the client machine in question, open CMD and type set.

The listed logon server is who the client device will use by default for all domain services, unless it doesn't respond, then the machine will query DNS again.

[Dashrender]

@G-I-Jones said in Group Policy points to wrong DC:

@scottalanmiller said in Group Policy points to wrong DC:

@G-I-Jones said in Group Policy points to wrong DC:

Your client devices will use the DC that is in their same site, and if there's more than one DC in it's site, the best DC will be chosen... which leads to the second point.

I guess what I was playing at was how I could trick the process of "the best DC will be chosen".

So if this is just an exercise in learning. Great. If not, let's back up. Why do you want to do this? What makes you feel one is better than another?

It really only boiled down to I don't want to wait 15 minutes (the minimum replication between DC's) for a GPO to apply.

Then, as you suggested, you need to see which server your client is querying, and make your changes directly there - then you can run gpupdate /force and you'll see your changes nearly immediately.

[G I Jones]

@Dashrender said in Group Policy points to wrong DC:

@G-I-Jones said in Group Policy points to wrong DC:

e secondary to another site, then it would default to the one I wanted it to, but I got two things wrong: first and most i

As I recall - it's either which ever DC is provided by DNS when a query for a DC is given, OR in the case of broadcast - whomever answers first.

Yea I think it might be the latter, as the DNS for my machine's NIC is pointing to the primary DC, but set replies with the secondary.

[scottalanmiller]

@G-I-Jones said in Group Policy points to wrong DC:

@scottalanmiller said in Group Policy points to wrong DC:

@G-I-Jones said in Group Policy points to wrong DC:

Your client devices will use the DC that is in their same site, and if there's more than one DC in it's site, the best DC will be chosen... which leads to the second point.

I guess what I was playing at was how I could trick the process of "the best DC will be chosen".

So if this is just an exercise in learning. Great. If not, let's back up. Why do you want to do this? What makes you feel one is better than another?

It really only boiled down to I don't want to wait 15 minutes (the minimum replication between DC's) for a GPO to apply.

Then time to go to a single DC

But GPOs aren't meant to work this way, really. If you want faster results, GPO is the wrong tool.

[scottalanmiller]

@G-I-Jones said in Group Policy points to wrong DC:

@Dashrender said in Group Policy points to wrong DC:

@G-I-Jones said in Group Policy points to wrong DC:

e secondary to another site, then it would default to the one I wanted it to, but I got two things wrong: first and most i

As I recall - it's either which ever DC is provided by DNS when a query for a DC is given, OR in the case of broadcast - whomever answers first.

Yea I think it might be the latter, as the DNS for my machine's NIC is pointing to the primary DC, but set replies with the secondary.

It's random to load balance.

[Dashrender]

@G-I-Jones said in Group Policy points to wrong DC:

@Dashrender said in Group Policy points to wrong DC:

@G-I-Jones said in Group Policy points to wrong DC:

e secondary to another site, then it would default to the one I wanted it to, but I got two things wrong: first and most i

As I recall - it's either which ever DC is provided by DNS when a query for a DC is given, OR in the case of broadcast - whomever answers first.

Yea I think it might be the latter, as the DNS for my machine's NIC is pointing to the primary DC, but set replies with the secondary.

you're misunderstanding DNS. The query the client machine is making is - give me the IP of a DC - ANY DC, and DNS is likely following a round robin affect and just handing out the IP of the next one that hasn't been handed out.
Let's assume there are 2 DCs.
ClientA queries for any DC - answer - DC1
ClientB queries for any DC - answer - DC2
ClientC queries for any DC - answer - DC1
etc

[Dashrender]

@scottalanmiller said in Group Policy points to wrong DC:

@G-I-Jones said in Group Policy points to wrong DC:

@Dashrender said in Group Policy points to wrong DC:

@G-I-Jones said in Group Policy points to wrong DC:

e secondary to another site, then it would default to the one I wanted it to, but I got two things wrong: first and most i

As I recall - it's either which ever DC is provided by DNS when a query for a DC is given, OR in the case of broadcast - whomever answers first.

Yea I think it might be the latter, as the DNS for my machine's NIC is pointing to the primary DC, but set replies with the secondary.

It's random to load balance.

Is it truly random? not just round-robin?

[scottalanmiller]

@Dashrender said in Group Policy points to wrong DC:

@scottalanmiller said in Group Policy points to wrong DC:

@G-I-Jones said in Group Policy points to wrong DC:

@Dashrender said in Group Policy points to wrong DC:

@G-I-Jones said in Group Policy points to wrong DC:

e secondary to another site, then it would default to the one I wanted it to, but I got two things wrong: first and most i

As I recall - it's either which ever DC is provided by DNS when a query for a DC is given, OR in the case of broadcast - whomever answers first.

Yea I think it might be the latter, as the DNS for my machine's NIC is pointing to the primary DC, but set replies with the secondary.

It's random to load balance.

Is it truly random? not just round-robin?

Well, it's round robin, but you can't know, as a client, how many queries are going on. So to you, it is random as there is a randomizer in the background.

Nothing is truly random in the universe. But to the client it is as random as anything else.

[DustinB3403]

@scottalanmiller said in Group Policy points to wrong DC:

Nothing is truly random in the universe.

Stars being born and dying isn't random?

[G I Jones]

@Dashrender said in Group Policy points to wrong DC:

@G-I-Jones said in Group Policy points to wrong DC:

@Dashrender said in Group Policy points to wrong DC:

@G-I-Jones said in Group Policy points to wrong DC:

e secondary to another site, then it would default to the one I wanted it to, but I got two things wrong: first and most i

As I recall - it's either which ever DC is provided by DNS when a query for a DC is given, OR in the case of broadcast - whomever answers first.

Yea I think it might be the latter, as the DNS for my machine's NIC is pointing to the primary DC, but set replies with the secondary.

you're misunderstanding DNS. The query the client machine is making is - give me the IP of a DC - ANY DC, and DNS is likely following a round robin affect and just handing out the IP of the next one that hasn't been handed out.
Let's assume there are 2 DCs.
ClientA queries for any DC - answer - DC1
ClientB queries for any DC - answer - DC2
ClientC queries for any DC - answer - DC1
etc

Ah, I see what you are saying here. Goes in with the idea that these are a pool. Appreciate that point of view, I hadn't thought of that just yet.

[Dashrender]

@G-I-Jones said in Group Policy points to wrong DC:

@Dashrender said in Group Policy points to wrong DC:

@G-I-Jones said in Group Policy points to wrong DC:

@Dashrender said in Group Policy points to wrong DC:

@G-I-Jones said in Group Policy points to wrong DC:

e secondary to another site, then it would default to the one I wanted it to, but I got two things wrong: first and most i

As I recall - it's either which ever DC is provided by DNS when a query for a DC is given, OR in the case of broadcast - whomever answers first.

Yea I think it might be the latter, as the DNS for my machine's NIC is pointing to the primary DC, but set replies with the secondary.

you're misunderstanding DNS. The query the client machine is making is - give me the IP of a DC - ANY DC, and DNS is likely following a round robin affect and just handing out the IP of the next one that hasn't been handed out.
Let's assume there are 2 DCs.
ClientA queries for any DC - answer - DC1
ClientB queries for any DC - answer - DC2
ClientC queries for any DC - answer - DC1
etc

Ah, I see what you are saying here. Goes in with the idea that these are a pool. Appreciate that point of view, I hadn't thought of that just yet.

This is one of the many things you learn reading a Windows Server/Active Directory book. Though everyone here will tell you that's a waste of time.

[G I Jones]

@scottalanmiller said in Group Policy points to wrong DC:

It really only boiled down to I don't want to wait 15 minutes (the minimum replication between DC's) for a GPO to apply.

Then time to go to a single DC

But GPOs aren't meant to work this way, really. If you want faster results, GPO is the wrong tool.

What alternative to Group Policy do you recommend?

[DustinB3403]

@G-I-Jones said in Group Policy points to wrong DC:

@scottalanmiller said in Group Policy points to wrong DC:

It really only boiled down to I don't want to wait 15 minutes (the minimum replication between DC's) for a GPO to apply.

Then time to go to a single DC

But GPOs aren't meant to work this way, really. If you want faster results, GPO is the wrong tool.

What alternative to Group Policy do you recommend?

Using a tool like PDQ Deploy is pretty smooth, but it's a substantial annual cost.

[Dashrender]

@G-I-Jones said in Group Policy points to wrong DC:

@scottalanmiller said in Group Policy points to wrong DC:

It really only boiled down to I don't want to wait 15 minutes (the minimum replication between DC's) for a GPO to apply.

Then time to go to a single DC

But GPOs aren't meant to work this way, really. If you want faster results, GPO is the wrong tool.

What alternative to Group Policy do you recommend?

Salt would likely be his first suggestion.

[Obsolesce]

@Dashrender said in Group Policy points to wrong DC:

@scottalanmiller said in Group Policy points to wrong DC:

@G-I-Jones said in Group Policy points to wrong DC:

@Dashrender said in Group Policy points to wrong DC:

@G-I-Jones said in Group Policy points to wrong DC:

e secondary to another site, then it would default to the one I wanted it to, but I got two things wrong: first and most i

As I recall - it's either which ever DC is provided by DNS when a query for a DC is given, OR in the case of broadcast - whomever answers first.

Yea I think it might be the latter, as the DNS for my machine's NIC is pointing to the primary DC, but set replies with the secondary.

It's random to load balance.

Is it truly random? not just round-robin?

AD is a multi-master system. The best DC for the client in the site will reply.