ASP Developer Network - Brought to you by Steve Radich and BitShop, Inc. - http://www.bitshop.com

ASPDeveloper

ASPDeveloper.Net / VirtualServerFAQ.COM

Make sure you go to our home page for:

* Virtual Server 2005 FAQ
* ASP.Net 2.0 Information
* ASP.Net 2.0 Streaming Tutorials
* ASP.Net 2.0 HTML based Tutorials

Made possible by Business Internet Technology Shop (BitShop)

Virtual Server 2005

Recent Virtual Server 2005 posts

* AD DC & SQL ALONGSIDE Hyper-V
* Strange Hyper-V VM network problem
* 2008 R2 Hyper-V
* Managing VMs on Perimiter networks
* Tools to migrate bare metal install to virtual machine?
* Installation of KB948515
* Hyper-v windows Server 2008 R2
* Vista Setup guide including IIS
* Portability for Hyper-V
* Microsoft Hyper-V Server 2008 R2 Hot Add / Remove Storage - How?
* Unix vhd compaction
* How to know virtual machine base machine ip
* Hyper V Manager without domain?
* Internet Explorer Hangs when lunching the admin site
* where is my RAID
* Hyper-V Server R2 and Raid5 Volume
* Pass through disk or ISCSI lun
* vseer auto start of vm
* Failover-Cluster on Hyper-V Server R2
* VMBUS network adapter failed to start (Code 10)

Add Solution

Host as member of AD?

Source: microsoft.public.virtualserver
Sent: 09/22/2009
From: "CourtK" <(email address - cut out)>
Message:

Is it supported to have the host joined to a domain when the AD is on a
child vm? Originally, I had no plans to join the host to the domain but we
are looking at Microsoft's Data Protection Manager, which requires the
server to be a member of a domain. Our environment is a single physical
server running Windows 2008 with Hyper-V with a 2008 DC as a child.

thanks,

Post Reply | This is Spam! | Mark as Spam

Related Messages

Re: Host as member of AD?

Sent: 09/22/2009
From: "Steve Jain [MVP]" <(email address - cut out)>
Message:

On Tue, 22 Sep 2009 13:08:02 -0700, "CourtK" <(email address - cut out)>
wrote:

No, it's not supported and is actually recommended not to do this
unless you have another physical AD controller.

You can run into troubles with your host being on the AD when there is
no way to validate the AD login.

--
Cheers,
Steve Jain, Virtual Machine MVP
http://vpc.essjae.com/

Show quoted text

>Is it supported to have the host joined to a domain when the AD is on a
>child vm? Originally, I had no plans to join the host to the domain but we
>are looking at Microsoft's Data Protection Manager, which requires the
>server to be a member of a domain. Our environment is a single physical
>server running Windows 2008 with Hyper-V with a 2008 DC as a child.
>
>thanks,

Re: Host as member of AD?

Sent: 09/22/2009
From: "Geoff N. Hiten" <(email address - cut out)>
Message:

If you do join the host to the domain, disable Time Sync for all VM domain
members.

---GNH

"CourtK" <(email address - cut out)> wrote in message
news:(email address - cut out)...

Show quoted text

> Is it supported to have the host joined to a domain when the AD is on a
> child vm? Originally, I had no plans to join the host to the domain but
> we are looking at Microsoft's Data Protection Manager, which requires the
> server to be a member of a domain. Our environment is a single physical
> server running Windows 2008 with Hyper-V with a 2008 DC as a child.
>
> thanks,

Re: Host as member of AD?

Sent: 09/23/2009
From: "CourtK" <(email address - cut out)>
Message:

Thanks for the response. Does Microsoft have documentation saying this? My
boss would rather see this in writing. I can't find documentation
supporting or refuting this anywhere and I see other posts on technet forums
that suggest otherwise.

-courtk

"Steve Jain [MVP]" <(email address - cut out)> wrote in message
news:(email address - cut out)...

Show quoted text

> On Tue, 22 Sep 2009 13:08:02 -0700, "CourtK" <(email address - cut out)>
> wrote:
>
>>Is it supported to have the host joined to a domain when the AD is on a
>>child vm? Originally, I had no plans to join the host to the domain but
>>we
>>are looking at Microsoft's Data Protection Manager, which requires the
>>server to be a member of a domain. Our environment is a single physical
>>server running Windows 2008 with Hyper-V with a 2008 DC as a child.
>>
>>thanks,
>
> No, it's not supported and is actually recommended not to do this
> unless you have another physical AD controller.
>
> You can run into troubles with your host being on the AD when there is
> no way to validate the AD login.
>
> --
> Cheers,
> Steve Jain, Virtual Machine MVP
> http://vpc.essjae.com/

Re: Host as member of AD?

Sent: 09/24/2009
From: Bo Berglund <(email address - cut out)>
Message:

On Wed, 23 Sep 2009 09:47:43 -0700, "CourtK" <(email address - cut out)>
wrote:

You can start by thinking along yourself:
1) You start a server (your virtualization host) that belongs to an AD
domain managed by a PDC, which is your guest
2) The server needs to authenticate with AD
3) The AD parent server (the guest) is not running
4) Authentication fails (of course)

So now the server runs without authentication (at best).

5) Now you want to log on to manage the server (to start the guest)
6) So you are asked for your credentials
7) These are now checked against AD, but PDC is not running so it
fails
8) You are refused login because you cannot be verified

==> Deadlock!

Not so hard to get, right?

--

Bo Berglund (Sweden)

Show quoted text

>"Steve Jain [MVP]" <(email address - cut out)> wrote in message
>news:(email address - cut out)...
>> On Tue, 22 Sep 2009 13:08:02 -0700, "CourtK" <(email address - cut out)>
>> wrote:
>>
>>>Is it supported to have the host joined to a domain when the AD is on a
>>>child vm? Originally, I had no plans to join the host to the domain but
>>>we
>>>are looking at Microsoft's Data Protection Manager, which requires the
>>>server to be a member of a domain. Our environment is a single physical
>>>server running Windows 2008 with Hyper-V with a 2008 DC as a child.
>>>
>>>thanks,
>>
>> No, it's not supported and is actually recommended not to do this
>> unless you have another physical AD controller.
>>
>> You can run into troubles with your host being on the AD when there is
>> no way to validate the AD login.
>>
>Thanks for the response. Does Microsoft have documentation saying this? My
>boss would rather see this in writing. I can't find documentation
>supporting or refuting this anywhere and I see other posts on technet forums
>that suggest otherwise.
>
>-courtk
>

Re: Host as member of AD?

Sent: 09/24/2009
From: "CourtK" <(email address - cut out)>
Message:

Thanks.

"Bill Grant" <not.available@online> wrote in message
news:(email address - cut out)...

Show quoted text

> How about this one.
>
> http://technet.microsoft.com/en-us/library/dd239199(WS.10).aspx
>
>
>
> "Bo Berglund" <(email address - cut out)> wrote in message
> news:(email address - cut out)...
>> On Wed, 23 Sep 2009 09:47:43 -0700, "CourtK" <(email address - cut out)>
>> wrote:
>>>"Steve Jain [MVP]" <(email address - cut out)> wrote in message
>>>news:(email address - cut out)...
>>>> On Tue, 22 Sep 2009 13:08:02 -0700, "CourtK" <(email address - cut out)>
>>>> wrote:
>>>>
>>>>>Is it supported to have the host joined to a domain when the AD is on a
>>>>>child vm? Originally, I had no plans to join the host to the domain
>>>>>but
>>>>>we
>>>>>are looking at Microsoft's Data Protection Manager, which requires the
>>>>>server to be a member of a domain. Our environment is a single
>>>>>physical
>>>>>server running Windows 2008 with Hyper-V with a 2008 DC as a child.
>>>>>
>>>>>thanks,
>>>>
>>>> No, it's not supported and is actually recommended not to do this
>>>> unless you have another physical AD controller.
>>>>
>>>> You can run into troubles with your host being on the AD when there is
>>>> no way to validate the AD login.
>>>>
>>
>>>Thanks for the response. Does Microsoft have documentation saying this?
>>>My
>>>boss would rather see this in writing. I can't find documentation
>>>supporting or refuting this anywhere and I see other posts on technet
>>>forums
>>>that suggest otherwise.
>>>
>>>-courtk
>>>
>> You can start by thinking along yourself:
>> 1) You start a server (your virtualization host) that belongs to an AD
>> domain managed by a PDC, which is your guest
>> 2) The server needs to authenticate with AD
>> 3) The AD parent server (the guest) is not running
>> 4) Authentication fails (of course)
>>
>> So now the server runs without authentication (at best).
>>
>> 5) Now you want to log on to manage the server (to start the guest)
>> 6) So you are asked for your credentials
>> 7) These are now checked against AD, but PDC is not running so it
>> fails
>> 8) You are refused login because you cannot be verified
>>
>> ==> Deadlock!
>>
>> Not so hard to get, right?
>>
>> --
>>
>> Bo Berglund (Sweden)
>

Re: Host as member of AD?

Sent: 09/24/2009
From: "CourtK" <(email address - cut out)>
Message:

9) Cached credentials
10) Log on locally
11) Setup VM's to start automatically

I know there are ways to get this to work but I just needed the MS docs to
say whether it was supported or not.

-courtk

"Bo Berglund" <(email address - cut out)> wrote in message
news:(email address - cut out)...

Show quoted text

> On Wed, 23 Sep 2009 09:47:43 -0700, "CourtK" <(email address - cut out)>
> wrote:
>>"Steve Jain [MVP]" <(email address - cut out)> wrote in message
>>news:(email address - cut out)...
>>> On Tue, 22 Sep 2009 13:08:02 -0700, "CourtK" <(email address - cut out)>
>>> wrote:
>>>
>>>>Is it supported to have the host joined to a domain when the AD is on a
>>>>child vm? Originally, I had no plans to join the host to the domain but
>>>>we
>>>>are looking at Microsoft's Data Protection Manager, which requires the
>>>>server to be a member of a domain. Our environment is a single physical
>>>>server running Windows 2008 with Hyper-V with a 2008 DC as a child.
>>>>
>>>>thanks,
>>>
>>> No, it's not supported and is actually recommended not to do this
>>> unless you have another physical AD controller.
>>>
>>> You can run into troubles with your host being on the AD when there is
>>> no way to validate the AD login.
>>>
>
>>Thanks for the response. Does Microsoft have documentation saying this?
>>My
>>boss would rather see this in writing. I can't find documentation
>>supporting or refuting this anywhere and I see other posts on technet
>>forums
>>that suggest otherwise.
>>
>>-courtk
>>
> You can start by thinking along yourself:
> 1) You start a server (your virtualization host) that belongs to an AD
> domain managed by a PDC, which is your guest
> 2) The server needs to authenticate with AD
> 3) The AD parent server (the guest) is not running
> 4) Authentication fails (of course)
>
> So now the server runs without authentication (at best).
>
> 5) Now you want to log on to manage the server (to start the guest)
> 6) So you are asked for your credentials
> 7) These are now checked against AD, but PDC is not running so it
> fails
> 8) You are refused login because you cannot be verified
>
> ==> Deadlock!
>
> Not so hard to get, right?
>
> --
>
> Bo Berglund (Sweden)

Re: Host as member of AD?

Sent: 09/24/2009
From: "Bill Grant" <not.available@online>
Message:

How about this one.

http://technet.microsoft.com/en-us/library/dd239199(WS.10).aspx

"Bo Berglund" <(email address - cut out)> wrote in message
news:(email address - cut out)...

Show quoted text

Re: Host as member of AD?

Sent: 09/25/2009
From: "Bill Grant" <not.available@online>
Message:

Yes, there are workarounds but they are not supported. If something goes
wrong, you are on your own. Spell that out to your boss.

"CourtK" <(email address - cut out)> wrote in message
news:(email address - cut out)...

Show quoted text

> 9) Cached credentials
> 10) Log on locally
> 11) Setup VM's to start automatically
>
> I know there are ways to get this to work but I just needed the MS docs to
> say whether it was supported or not.
>
> -courtk
>
> "Bo Berglund" <(email address - cut out)> wrote in message
> news:(email address - cut out)...
>> On Wed, 23 Sep 2009 09:47:43 -0700, "CourtK" <(email address - cut out)>
>> wrote:
>>>"Steve Jain [MVP]" <(email address - cut out)> wrote in message
>>>news:(email address - cut out)...
>>>> On Tue, 22 Sep 2009 13:08:02 -0700, "CourtK" <(email address - cut out)>
>>>> wrote:
>>>>
>>>>>Is it supported to have the host joined to a domain when the AD is on a
>>>>>child vm? Originally, I had no plans to join the host to the domain
>>>>>but
>>>>>we
>>>>>are looking at Microsoft's Data Protection Manager, which requires the
>>>>>server to be a member of a domain. Our environment is a single
>>>>>physical
>>>>>server running Windows 2008 with Hyper-V with a 2008 DC as a child.
>>>>>
>>>>>thanks,
>>>>
>>>> No, it's not supported and is actually recommended not to do this
>>>> unless you have another physical AD controller.
>>>>
>>>> You can run into troubles with your host being on the AD when there is
>>>> no way to validate the AD login.
>>>>
>>
>>>Thanks for the response. Does Microsoft have documentation saying this?
>>>My
>>>boss would rather see this in writing. I can't find documentation
>>>supporting or refuting this anywhere and I see other posts on technet
>>>forums
>>>that suggest otherwise.
>>>
>>>-courtk
>>>
>> You can start by thinking along yourself:
>> 1) You start a server (your virtualization host) that belongs to an AD
>> domain managed by a PDC, which is your guest
>> 2) The server needs to authenticate with AD
>> 3) The AD parent server (the guest) is not running
>> 4) Authentication fails (of course)
>>
>> So now the server runs without authentication (at best).
>>
>> 5) Now you want to log on to manage the server (to start the guest)
>> 6) So you are asked for your credentials
>> 7) These are now checked against AD, but PDC is not running so it
>> fails
>> 8) You are refused login because you cannot be verified
>>
>> ==> Deadlock!
>>
>> Not so hard to get, right?
>>
>> --
>>
>> Bo Berglund (Sweden)
>

Post Reply | This is Spam! | Mark as Spam

Other groups

Virtual PC (Mac)(3592)	Virtual PC(12844)	Virtual PC (French)(496)
Virtual Server 2005(6245)

Our Sponsors

Virtual Server 2005 Info Here!
http://www.aspdeveloper.net

Wiki

Blogs

Articles

Image galleries

File galleries

Forums

Maps

Directories

ASP Developer Network (since 1996) - Brought to you by Steve Radich and BitShop, Inc. - http://www.bitshop.com
Copyright © 1997-2005 by BitShop, Inc. All Rights Reserved.
No content may be reproduced in any form without written permission from BitShop, Inc.
We will be honored to assist with reproduction rights on our material if you contact us.
We also can provide print articles for your magazine, private training seminars at your site, and conference presentations.
Thank you for visiting. Please bookmark our site if you found it useful!
If you wish to make a donation it will help further the development of these free resources: