1. Make sure not all DC’s are rebooted at once; stagger them out a bit.
2. Make sure clients are not pointing to DC’s acting as DNS servers that are all being rebooted at once.
3. Make sure you are using a patching system so you don’t miss DC’s; these include WSUS , SCCM , or a third party.
4. Do it all off hours to minimize service interruption and maximize recover time if a DC doesn’t want to come back up!
1. The computer will not self-maintain that SPN, unlike the other SPN’s.
2. This means you will need to maintain this on all SPN’s for all file servers.
3. It also means you need to remember to change this when IP addresses change, or serious confusion will ensue.
4. It also means all IT staff will need to know this, since you will not be there forever and you may like taking vacation from time to time.
5. It also means that if anyone forgets any of this, huge numbers of computers will not be getting policy/scripts and unless you are monitoring all client event logs, you won’t know it.
6. Update Jan 21 2011: and starting in Vista, it won't work at all!
Active Directory Replication Model
Active Directory Replication Topology
Public Key Infrastructure (PKI)
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.