Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
Domain controller (Windows)
open-in-new
<h2 id="history">History</h2> <p>One domain controller per domain was configured as the primary domain controller (PDC), all other domain controllers were backup domain controllers (BDC). </p><p>Because of the critical nature of the PDC, best practices dictated that the PDC should be dedicated solely to domain services, and not used for file, print or application services that could slow down or crash the system. Some network administrators took the additional step of having a dedicated BDC online for the express purpose of being available for promotion if the PDC failed. </p><p>A BDC could authenticate the users in a domain, but all updates to the domain could only be made via the PDC, which would then propagate these changes to all BDCs in the domain. If the PDC was unavailable the update would fail. If the PDC was permanently unavailable an existing BDC could be promoted to be and later versions introduced <a href="/facts/Active_Directory/VWd9HhjU">Active Directory</a> ("AD"), which largely eliminated the concept of PDC and BDC in favor of <a href="/facts/Multi-master_replication/0s9qDWaD">multi-master replication</a>. However, there are still several roles that only one domain controller can perform, called the <a href="/facts/Flexible_single_master_operation/HvRTxsEz">Flexible single master operation</a> roles. Some of these roles must be filled by one DC per domain, while others only require one DC per <a href="/facts/Active_Directory/VWd9HhjU">AD Forest</a>. If the server performing one of these roles is lost, the domain can still function, and if the server will not be available again, an administrator can designate an alternate DC to assume the role in a process known as "seizing" the role. </p> <h2 id="primary-domain-controller">Primary domain controller</h2> <p>In Windows NT 4, one DC serves as the primary domain controller (PDC). Others, if they exist, are usually a backup domain controller (BDC). The PDC is typically designated as the "first".<a class="footnote-ref" id="fnref:5" href="#fn:5"><sup>5</sup></a> The "User Manager for Domains" is a utility for maintaining user/group information. It uses the domain security database on the primary controller. The PDC has the master copy of the user accounts database which it can access and modify. The BDC computers have a copy of this database, but these copies are read-only. The PDC will replicate its account database to the BDCs on a regular basis.<a class="footnote-ref" id="fnref:6" href="#fn:6"><sup>6</sup></a> The BDCs exist in order to provide a backup to the PDC, and can also be used to authenticate users logging on to the network. If a PDC should fail, one of the BDCs can then be promoted to take its place. The PDC will usually be the first domain controller that was created unless it was replaced by a promoted BDC. </p> <h3>PDC emulation (Primary Domain Controller)</h3> <p>In modern releases of Windows, domains have been supplemented by the use of <a href="/facts/Active_Directory/VWd9HhjU">Active Directory</a> services. In Active Directory domains, the concept of primary and secondary domain controller relationships no longer applies. PDC emulators hold the accounts databases and administrative tools. As a result, a heavy workload can slow the system down. The DNS service may be installed on a secondary emulator machine to relieve the workload on the PDC emulator. The same rules apply; only one PDC may exist on a domain, but multiple replication servers may still be used.<a class="footnote-ref" id="fnref:7" href="#fn:7"><sup>7</sup></a> </p> <ul><li>The PDC emulator master acts in place of the PDC if there are <a href="/facts/Windows_NT_4.0/EcKYxrkx">Windows NT 4.0</a> domain controllers (BDCs) remaining within the domain, acting as a source for them to replicate from.</li> <li>The PDC emulator master receives preferential replication of password changes within the domain. As password changes take time to replicate across all the domain controllers in an Active Directory domain, the PDC emulator master receives notification of password changes immediately, and if a logon attempt fails at another domain controller, that domain controller will forward the logon request to the PDC emulator master before rejecting it.</li> <li>The PDC emulator master also serves as the machine to which all domain controllers in the domain will synchronise their clocks. It, in turn, should be configured to synchronise to an external <a href="/facts/Network_Time_Protocol/vS21KqT5">NTP</a> time source.<a class="footnote-ref" id="fnref:8" href="#fn:8"><sup>8</sup></a></li></ul> <h3>Samba</h3> <p>Primary Domain Controllers (PDC) have been faithfully recreated on the <a href="/facts/Samba_software/Huyc2pnX">Samba</a> emulation of Microsoft's <a href="/facts/Server_message_block/pWM35pl8">SMB</a> client/server system. <a href="/facts/Samba_software/Huyc2pnX">Samba</a> has the capability to emulate an NT 4.0 domain, as well as modern Active Directory Domain Services<a class="footnote-ref" id="fnref:9" href="#fn:9"><sup>9</sup></a> on a <a href="/facts/Linux/9FvCKSTq">Linux</a> machine.<a class="footnote-ref" id="fnref:10" href="#fn:10"><sup>10</sup></a> </p> <h2 id="backup-domain-controller">Backup domain controller</h2> <p>In Windows NT 4 domains, the backup domain controller (BDC) is a computer that has a copy of the user accounts database. Unlike the accounts database on the PDC, the BDC database is a read-only copy. When changes are made to the master accounts database on the PDC, the PDC pushes the updates down to the BDCs. These additional domain controllers exist to provide fault tolerance. If the PDC fails, then it can be replaced by a BDC. In such circumstances, an administrator promotes a BDC to be the new PDC. BDCs can also authenticate user logon requests and take some of the authentication load from the PDC. </p><p>When <a href="/facts/Windows_2000/amJIt9gz">Windows 2000</a> was released, the NT domain as found in NT 4 and prior versions was replaced by <a href="/facts/Active_Directory/VWd9HhjU">Active Directory</a>. In Active Directory domains running in native mode, the concept of the PDC and BDC do not exist. In these domains, all domain controllers are considered equals. A side effect of this change is the loss of ability to create a "read-only" domain controller. <a href="/facts/Windows_Server_2008/hrcPjTCH">Windows Server 2008</a> reintroduced this capability. </p> <h2 id="nomenclature">Nomenclature</h2> <p>Windows Server can be one of three kinds: Active Directory "domain controllers" (ones that provide identity and authentication), Active Directory "member servers" (ones that provide complementary services such as file repositories and schema) and <a href="/facts/Features_new_to_Windows_7/qT863ady">Windows Workgroup</a> "stand-alone servers".<a class="footnote-ref" id="fnref:11" href="#fn:11"><sup>11</sup></a> The term "Active Directory Server" is sometimes used by Microsoft as synonymous to "Domain Controller"<a class="footnote-ref" id="fnref:12" href="#fn:12"><sup>12</sup></a><a class="footnote-ref" id="fnref:13" href="#fn:13"><sup>13</sup></a><a class="footnote-ref" id="fnref:14" href="#fn:14"><sup>14</sup></a><a class="footnote-ref" id="fnref:15" href="#fn:15"><sup>15</sup></a><a class="footnote-ref" id="fnref:16" href="#fn:16"><sup>16</sup></a> but the term is discouraged.<a class="footnote-ref" id="fnref:17" href="#fn:17"><sup>17</sup></a> </p> <h2 id="external-links">External links</h2> <ul><li><a href="http://support.microsoft.com/kb/247811">How domain controllers are located in Windows</a></li> <li><a href="http://www.turnkeylinux.org/domain-controller">Pre-integrated open source domain controller</a></li></ul> <h2 id="references">References</h2> <ol> <li id="fn:1"><p>"Domain Controller Roles". Microsoft TechNet or A domain controller (DC) is a server that responds to security authentication requests within a Windows Server domain. It is a server on a Microsoft Windows or Windows NT network that is responsible for allowing host access to Windows domain resources. A domain controller is the centerpiece of the Windows Active Directory service. It authenticates users, stores user account information and enforces security policy for a Windows domain. Retrieved Dec 4, 2009. <a href="https://technet.microsoft.com/en-us/library/cc786438(WS.10).aspx" target="_blank">https://technet.microsoft.com/en-us/library/cc786438(WS.10).aspx</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li> <li id="fn:2"><p>"Domain Controller Roles". Windows Server 2003 Technical Reference. Microsoft TechNet. 2010-06-03. Retrieved 2012-11-21. A domain controller is a server that is running a version of the Windows Server® operating system and has Active Directory® Domain Services installed. <a href="https://technet.microsoft.com/en-us/library/cc786438(WS.10).aspx" target="_blank">https://technet.microsoft.com/en-us/library/cc786438(WS.10).aspx</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li> <li id="fn:3"><p>"What is a Domain Controller? - Definition from Techopedia". Techopedia.com. Retrieved 2016-11-16. <a href="https://www.techopedia.com/definition/4193/domain-controller" target="_blank">https://www.techopedia.com/definition/4193/domain-controller</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li> <li id="fn:4"><p>"Answering: What Is a Domain Controller & What Does it Do?". scientificera.com. Retrieved 2016-11-16. <a href="http://scientificera.com/windows/45-windows/224-what-is-a-domain-controller.html" target="_blank">http://scientificera.com/windows/45-windows/224-what-is-a-domain-controller.html</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li> <li id="fn:5"><p>"Domain Controller Roles". Microsoft Tech net 3 June 2010. Retrieved 13 February 2011. <a href="https://technet.microsoft.com/en-us/library/cc786438%28WS.10%29.aspx" target="_blank">https://technet.microsoft.com/en-us/library/cc786438%28WS.10%29.aspx</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li> <li id="fn:6"><p>"Peer-to-Peer Transactional Replication". Microsoft Technet - date undisclosed. Retrieved 13 February 2011. <a href="https://technet.microsoft.com/en-us/library/ms151196.aspx" target="_blank">https://technet.microsoft.com/en-us/library/ms151196.aspx</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li> <li id="fn:7"><p>"Reducing the Workload on the PDC Emulator Master". Microsoft Technet 9 January 2009. Retrieved 13 February 2011. <a href="https://technet.microsoft.com/en-us/library/cc816793%28WS.10%29.aspx" target="_blank">https://technet.microsoft.com/en-us/library/cc816793%28WS.10%29.aspx</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></p></li> <li id="fn:8"><p>"Configure the Time Source for the Forest". Microsoft Technet 9 January 2009. Retrieved 13 February 2011. <a href="https://technet.microsoft.com/en-us/library/cc794937%28WS.10%29.aspx" target="_blank">https://technet.microsoft.com/en-us/library/cc794937%28WS.10%29.aspx</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></p></li> <li id="fn:9"><p>"Setting up Samba as an Active Directory Domain Controller - SambaWiki". wiki.samba.org. Retrieved 2018-04-20. <a href="https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller" target="_blank">https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></p></li> <li id="fn:10"><p>"Server Manager Shows PDC and BDC as Workstations with Samba Linux Server in Network". Microsoft Technet 1 November 2006. Retrieved 13 February 2011. <a href="http://support.microsoft.com/kb/250263" target="_blank">http://support.microsoft.com/kb/250263</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></p></li> <li id="fn:11"><p>"Planning for domain controllers and member servers". Windows Server 2003 Product Help. Microsoft TechNet. 2005-01-21. Retrieved 2012-11-21. [...] servers in a domain can have one of two roles: domain controllers, which contain matching copies of the user accounts and other Active Directory data in a given domain, and member servers, which belong to a domain but do not contain a copy of the Active Directory data. (A server that belongs to a workgroup, not a domain, is called a stand-alone server.) <a href="https://technet.microsoft.com/en-us/library/cc737059.aspx" target="_blank">https://technet.microsoft.com/en-us/library/cc737059.aspx</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></p></li> <li id="fn:12"><p>"Capacity Planning for Active Directory Domain Services". Microsoft TechNet. 2012-10-12. Archived from the original on 2012-11-29. Retrieved 2012-11-21. Evaluating Active Directory Server RAM [...] Evaluating the amount of RAM that a domain controller (DC) needs is actually quite a complex exercise. <a href="https://web.archive.org/web/20121129084522/http://technet.microsoft.com/en-us/library/capacity-planning-for-domain-controllers.aspx" target="_blank">https://web.archive.org/web/20121129084522/http://technet.microsoft.com/en-us/library/capacity-planning-for-domain-controllers.aspx</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></p></li> <li id="fn:13"><p>"Q324753: How To Create an Active Directory Server in Windows Server 2003". Microsoft Support. 2011-09-11. Retrieved 2012-11-21. How To Create an Active Directory Server in Windows Server 2003 [...] To convert a Windows Server 2003 computer into the first domain controller in the forest, follow these steps [...] <a href="http://support.microsoft.com/kb/324753/" target="_blank">http://support.microsoft.com/kb/324753/</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></p></li> <li id="fn:14"><p>"Q302914: How Outlook 2000 accesses Active Directory". Microsoft Support. 2007-02-27. Retrieved 2012-11-21. [...] you must restart Outlook if that particular Active Directory server stops responding. <a href="http://support.microsoft.com/kb/302914/" target="_blank">http://support.microsoft.com/kb/302914/</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></p></li> <li id="fn:15"><p>"Q253841: XADM: Troubleshooting Active Directory Connector Replication Issues". Microsoft Support. 2007-02-27. Retrieved 2012-11-21. Is a Connection Agreement configured for the Exchange Server computer to the Active Directory server? <a href="http://support.microsoft.com/kb/253841/" target="_blank">http://support.microsoft.com/kb/253841/</a> <a href="#fnref:15" class="footnote-back-ref">↩</a></p></li> <li id="fn:16"><p>"Q825916: Exchange 2000 Active Directory Connector Does Not Successfully Replicate Changes to Group Membership in Windows Server 2003 Active Directory in Forest Functional Levels 1 or 2". Microsoft Support. 2006-10-27. Retrieved 2012-11-21. [...] changes do not replicate between a Windows Server 2003 Active Directory server (in forest functional level 1 or in forest functional level 2) and a Microsoft Exchange Server 5.5 computer [...] <a href="http://support.microsoft.com/kb/825916/" target="_blank">http://support.microsoft.com/kb/825916/</a> <a href="#fnref:16" class="footnote-back-ref">↩</a></p></li> <li id="fn:17"><p>Comment officially marked as "answer" by Microsoft-employed forum moderator "Arthur_Li". Jorge Mederos (2010-10-11). "AD server vs. Domain Controller vs. Member Server, et al". Microsoft TechNet Forums. Archived from the original on 2013-01-03. Retrieved 2012-11-21. [...] the term "AD Servers" is not a phrase you will find in any of the technical books and I myself have not heard that term used in the industry. <a href="https://archive.today/20130103233916/http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/60e064b5-5c6f-4c96-9abb-e3e51f4265c9/" target="_blank">https://archive.today/20130103233916/http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/60e064b5-5c6f-4c96-9abb-e3e51f4265c9/</a> <a href="#fnref:17" class="footnote-back-ref">↩</a></p></li> </ol>