View Full Version : Load Balancing User Logins in Windows 2003 Active Directory


Ken Windancer
Hello:

I have a LAN site with 1200 users and PCs logging into Windows 2003 Active
Directory, mixed mode environment.

I would like to setup load balancing for users logging into the domain
between the two domain controllers.

Any suggestions would be appreciated.

Ken



Dave Shaw [MVP]
I'd be interested in knowing why you feel the need to load balance 2 servers
and 1200 users.

I have one site alone with over 12,000 users on it and only 4 domain
controllers that are barely breathing ...

What's your hardware/network look like?


-ds



"Ken Windancer" wrote in message
news:up61h82FEHA.3456@tk2msftngp13.phx.gbl...
> Hello:
>
> I have a LAN site with 1200 users and PCs logging into Windows 2003 Active
> Directory, mixed mode environment.
>
> I would like to setup load balancing for users logging into the domain
> between the two domain controllers.
>
> Any suggestions would be appreciated.
>
> Ken
>
>



Oli Restorick [MVP]
If the two domain controllers are both in the same AD site, they already
load balance.

Oli


"Ken Windancer" wrote in message
news:up61h82FEHA.3456@tk2msftngp13.phx.gbl...
> Hello:
>
> I have a LAN site with 1200 users and PCs logging into Windows 2003 Active
> Directory, mixed mode environment.
>
> I would like to setup load balancing for users logging into the domain
> between the two domain controllers.
>
> Any suggestions would be appreciated.
>
> Ken
>
>



Dave Shaw [MVP]
Actually, they technically don't "load balance". There is no mechanism
between domain controllers that ensures they are balanced. What will happen
is; the least busy domain controller will respond faster to logon requests
that the busier one. But I think your point is that it would be good
enough.

-ds


"Oli Restorick [MVP]" wrote in message
news:eqnIbs3FEHA.4012@TK2MSFTNGP09.phx.gbl...
> If the two domain controllers are both in the same AD site, they already
> load balance.
>
> Oli
>
>
> "Ken Windancer" wrote in message
> news:up61h82FEHA.3456@tk2msftngp13.phx.gbl...
> > Hello:
> >
> > I have a LAN site with 1200 users and PCs logging into Windows 2003
Active
> > Directory, mixed mode environment.
> >
> > I would like to setup load balancing for users logging into the domain
> > between the two domain controllers.
> >
> > Any suggestions would be appreciated.
> >
> > Ken
> >
> >
>
>



Cary Shultz [A.D. MVP]
Dave,

Please correct me if I am wrong but this could be 'controlled' by modifying
either / both the Priority and Weight. Out of the box all DCs have a
priority of [0] and a weight of [100]. This could be modified so that one
DC will authenticate twice as many or four times as many logons as the other
( in a two DC environment ).

Cary

"Dave Shaw [MVP]" wrote in message
news:ewj91qQGEHA.2808@TK2MSFTNGP10.phx.gbl...
> Actually, they technically don't "load balance". There is no mechanism
> between domain controllers that ensures they are balanced. What will
happen
> is; the least busy domain controller will respond faster to logon requests
> that the busier one. But I think your point is that it would be good
> enough.
>
> -ds
>
>
> "Oli Restorick [MVP]" wrote in message
> news:eqnIbs3FEHA.4012@TK2MSFTNGP09.phx.gbl...
> > If the two domain controllers are both in the same AD site, they already
> > load balance.
> >
> > Oli
> >
> >
> > "Ken Windancer" wrote in message
> > news:up61h82FEHA.3456@tk2msftngp13.phx.gbl...
> > > Hello:
> > >
> > > I have a LAN site with 1200 users and PCs logging into Windows 2003
> Active
> > > Directory, mixed mode environment.
> > >
> > > I would like to setup load balancing for users logging into the domain
> > > between the two domain controllers.
> > >
> > > Any suggestions would be appreciated.
> > >
> > > Ken
> > >
> > >
> >
> >
>
>



Brian Desmond [MVP]
No. This is a site link cost. Basically, the site link with the lowest cost
will be used first/most often for intersite traffic between sites.

--
--
Brian Desmond
Windows Server MVP
desmondb@payton.cps.k12.il.us

Http://www.briandesmond.com


"Cary Shultz [A.D. MVP]" wrote in message
news:eKy9IrYGEHA.2576@TK2MSFTNGP11.phx.gbl...
> Dave,
>
> Please correct me if I am wrong but this could be 'controlled' by
modifying
> either / both the Priority and Weight. Out of the box all DCs have a
> priority of [0] and a weight of [100]. This could be modified so that
one
> DC will authenticate twice as many or four times as many logons as the
other
> ( in a two DC environment ).
>
> Cary
>
> "Dave Shaw [MVP]" wrote in message
> news:ewj91qQGEHA.2808@TK2MSFTNGP10.phx.gbl...
> > Actually, they technically don't "load balance". There is no mechanism
> > between domain controllers that ensures they are balanced. What will
> happen
> > is; the least busy domain controller will respond faster to logon
requests
> > that the busier one. But I think your point is that it would be good
> > enough.
> >
> > -ds
> >
> >
> > "Oli Restorick [MVP]" wrote in message
> > news:eqnIbs3FEHA.4012@TK2MSFTNGP09.phx.gbl...
> > > If the two domain controllers are both in the same AD site, they
already
> > > load balance.
> > >
> > > Oli
> > >
> > >
> > > "Ken Windancer" wrote in message
> > > news:up61h82FEHA.3456@tk2msftngp13.phx.gbl...
> > > > Hello:
> > > >
> > > > I have a LAN site with 1200 users and PCs logging into Windows 2003
> > Active
> > > > Directory, mixed mode environment.
> > > >
> > > > I would like to setup load balancing for users logging into the
domain
> > > > between the two domain controllers.
> > > >
> > > > Any suggestions would be appreciated.
> > > >
> > > > Ken
> > > >
> > > >
> > >
> > >
> >
> >
>
>



Cary Shultz [A.D. MVP]
Brian,

Sorry. Should have been more explicit.

I was referring to modifying the weight and/or priority of the DCs' records
in the DNS console so that you give one DC a weight of, say, 80 and the
other a weight of, say, 20 while maintaining the priority of 0. This will
make it so that the DC with the weight of 80 will process roughly 4x the
number of logon requests that the DC with the weight of 20 will. As it
stands all DCs - out of the box - have a priority of [0] and a weight of
[100]. Out of the box all DCs will process roughly the same number of logon
requests.

So, as an example, the records would look like this out of the box

Left side of the console

Forward Lookup Zone

mydomain.com

_msdcs

dc

sites

D-F-S-N

_tcp


right side of the console

_kerberos [0][100][88]
dc01.mydomain.com
_kerberos [0][100][88]
dc02.mydomain.com
_ldap [0][100][389]
dc01.mydomain.com
_ldap [0][100][389]
dc02.mydomain.com



We would change this so that it looks like this:

_kerberos [0][80][88]
dc01.mydomain.com
_kerberos [0][20][88]
dc02.mydomain.com
_ldap [0][80][389]
dc01.mydomain.com
_ldap [0][20][389]
dc02.mydomain.com

As you well know, clients try to authenticate against the DC with the lowest
priority ( in this case, both have a priority of [0] ). In cases where the
DCs have the same priority the weight value is used to determine the ratio.
Not very well worded but hopefully you get what I am saying.

Take a look at the following article:

http://www.winnetmag.com/articles/print.cfm?ArticleID=37935

It words things much better.


Cary


"Brian Desmond [MVP]" wrote in message
news:%235MJihsGEHA.1240@TK2MSFTNGP10.phx.gbl...
> No. This is a site link cost. Basically, the site link with the lowest
cost
> will be used first/most often for intersite traffic between sites.
>
> --
> --
> Brian Desmond
> Windows Server MVP
> desmondb@payton.cps.k12.il.us
>
> Http://www.briandesmond.com
>
>
> "Cary Shultz [A.D. MVP]" wrote in message
> news:eKy9IrYGEHA.2576@TK2MSFTNGP11.phx.gbl...
> > Dave,
> >
> > Please correct me if I am wrong but this could be 'controlled' by
> modifying
> > either / both the Priority and Weight. Out of the box all DCs have a
> > priority of [0] and a weight of [100]. This could be modified so that
> one
> > DC will authenticate twice as many or four times as many logons as the
> other
> > ( in a two DC environment ).
> >
> > Cary
> >
> > "Dave Shaw [MVP]" wrote in message
> > news:ewj91qQGEHA.2808@TK2MSFTNGP10.phx.gbl...
> > > Actually, they technically don't "load balance". There is no
mechanism
> > > between domain controllers that ensures they are balanced. What will
> > happen
> > > is; the least busy domain controller will respond faster to logon
> requests
> > > that the busier one. But I think your point is that it would be good
> > > enough.
> > >
> > > -ds
> > >
> > >
> > > "Oli Restorick [MVP]" wrote in message
> > > news:eqnIbs3FEHA.4012@TK2MSFTNGP09.phx.gbl...
> > > > If the two domain controllers are both in the same AD site, they
> already
> > > > load balance.
> > > >
> > > > Oli
> > > >
> > > >
> > > > "Ken Windancer" wrote in message
> > > > news:up61h82FEHA.3456@tk2msftngp13.phx.gbl...
> > > > > Hello:
> > > > >
> > > > > I have a LAN site with 1200 users and PCs logging into Windows
2003
> > > Active
> > > > > Directory, mixed mode environment.
> > > > >
> > > > > I would like to setup load balancing for users logging into the
> domain
> > > > > between the two domain controllers.
> > > > >
> > > > > Any suggestions would be appreciated.
> > > > >
> > > > > Ken
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>