Chris and Daves SharePoint and Tech Blog

You may be aware of a constant debate that goes on between myself, Dave and a few others in education about running virtual environments and whether they should/could be 100% virtual of if you would need some physical domain controllers put into the mix. If you’re not familiar with the debate have a quick read of this http://sharepointineducation.com/?p=2056

So as you see, I’ve always maintained that you can have a completely virtual environment and in theory it’s all fine.

Well theory came crashing into reality this week. There was a planned power outage at school; the only flaw in the plan was that no one told us. We made it to the server room just in time to watch the UPS run out and experience the eeary sensation of a silent server room. One of the things to die was a fully virtual environment we have been playing with. The two node hyper v cluster is part of the same domain as the virtual machines that run on them. They both go off because of power and you have no domain. The theory being that you can just log in locally and start the DC, then boot 2^nd node then reboot node 1. What I hadn’t taken into account was that the cluster would not load and the DC was not available to boot from the cluster manager.

Lessons were learnt. Here they are.

If running a fully virtual environment the failover cluster and associated cluster shared volume will not start as there is no domain – this is a problem.

We fixed it by removing the cluster volume and just assigning it a drive letter on node 1 of the hyper cluster, the VHD for the domain controller could then be copied onto the local C: of node 1 and fired up via hyper-v manager. The 2^nd node could then be fired up and now having a domain to join was fine and the cluster volume was all good. The 2^nd DC was then moved to the C: of node 2. Node 1 could then be restarted and all was good from then on.

So if you go fully virtual don’t put all your domain controllers in the cluster, keep them local, one on each node as they can be started independently of shared storage or cluster.

Although I still wouldn’t be brave stupid enough to do this in production

 I have been having a Twitter conversation with Martin Byford-Rew the IT Manager at Thomas Deacon Academy in Peterborough and others about finding stale accounts in active directory, now I do not have that concern as I use an AD tools which runs overnight and creates or archives accounts as pupils, staff and parents arrive at or leave Twynham, but more of that in a later post.

 Before we used the current AD tools I also had the same problem with keeping Active Directory tidy and up to date the only way I found before reaching for scripting tools was to use the query tools available in Active Directory so I hope this post helps Martin.

1. Open Active Directory users and computers at the top you will see “saved queries”
2. Right click Saved Queries and choose new query
3. Put a name in the name field I chose “Not Logged On For 30 Days”
4. You can choose to query the whole of your directory or just one OU
5. Click Define Query
6. If you are only interested in finding accounts that have not logged on for a while you get the choice between 30,60,90,120 or 180 days since last logon

We only use these queries now to check out parental accounts for inactivity but a tool that is built in but rarely used. Below you can see the results of the query that we created.