← All tutorials

Active Directory

Add a second domain controller for reliability

Keep logins working when a server fails, by running a second copy of your directory.

Intermediate10 min read5 steps

  1. PrepareServer joins domain
  2. InstallAdd the role
  3. PromoteSecond controller
  4. VerifyCheck replication

What you need

  • A second Windows Server, ideally on separate hardware
  • A working first domain controller
  • An account with Domain Admin rights

  1. Prepare the second server

    Set a fixed IP address, point its DNS at the first domain controller, rename it, and join it to the domain. Use the commands from the earlier tutorials, changing the name and address.

    New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 192.168.10.11 -PrefixLength 24 -DefaultGateway 192.168.10.1
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 192.168.10.10
Add-Computer -NewName "DC02" -DomainName "corp.example.com" -Credential "CORP\Administrator" -Restart

  2. Install the role and promote the server

    This copies the directory from the existing domain controller and installs DNS. The server restarts when it finishes.

    Install-WindowsFeature AD-Domain-Services -IncludeManagementTools

Install-ADDSDomainController `
  -DomainName "corp.example.com" `
  -InstallDns `
  -Credential (Get-Credential "CORP\Administrator") `
  -SafeModeAdministratorPassword (Read-Host -AsSecureString "DSRM password")

  3. Check that the two servers replicate

    Run these on either domain controller. Investigate any failures before you rely on the second server. As a simple test, create a user on one and check it appears on the other.

    repadmin /replsummary
repadmin /showrepl
dcdiag /q

  4. Tell computers to use both DNS servers

    Add both addresses as DNS servers for computers on the network, usually through your DHCP settings. If computers only know about one server, they may not find the domain when it is down.

  5. Test a failure, and keep your backups

    During a quiet time, shut down the first server and check that users can still sign in. Keep backing up the directory, because a second domain controller also replicates mistakes and deletions.

    Avoid restoring a domain controller from an old virtual machine snapshot unless you have checked the supported recovery process.

Want this set up for your business?

We can plan, build and hand it over to your team.

Discuss your setup ↗
Next tutorialSet up your company's first Active Directory domain →