Best Practices for Virtualizing Active Directory

Transcription

1 Best Practices for Virtualizing Active Directory Breakout Session AP01 Chris Skinner Senior Technical Instructor,VMware, Inc. February 25, 2009

2 Disclaimer This session may contain product features that are currently under development. This session/overview of the new technology represents no commitment from VMware to deliver these features in any generally available product. Features are subject to change, and must not be included in contracts, purchase orders, or sales agreements of any kind. Technical feasibility and market demand will affect final delivery. Pricing and packaging for any new technologies or features discussed or presented have not been determined. These features are representative of feature areas under development. Feature commitments are subject to change, and must not be included in contracts, purchase orders, or sales agreements of any kind. Technical feasibility and market demand will affect final delivery.

3 Objectives and Goals You can virtualize Active Directory successfully It s not difficult, mystical or magical Many companies have successfully deployed AD through virtualization

4 Agenda Why should we virtualize Active Directory? What are the challenges with virtualizing AD? How does a company successfully migrate?

5 Why Virtualize?

6 Why Virtualize Active Directory? Hardware Consolidation Combine multiple, single use boxes Standardization eliminating imaging issues Reduce product activation issues Leverage VI 3 Features HA & DRS

7 Why Virtualize Active Directory? Testing and Development Policy testing Schema changes Migration/upgrade testing Domain reconfigurations Deployment scenarios Disaster recovery solutions

8 Why Virtualize Active Directory? Security Controls Limiting physical access Additional administrative controls Separate applications from domain controllers

9 Challenges to Virtualizing Active Directory Time synchronization Performance Replicating Active Directory changes High availability of domain controllers Disaster recovery

10 Time Synchronization Virtualization Challenges

11 Time Synchronization Why is it so important? Active Directory operations are critically time dependent MS Kerberos implementation allows a 5 minute tolerance File Replication Services (FRS) synchronizes scripts, database changes/updates, policies based, in part, on time-stamping

12 Time Server Hierarchies Child PDC emulators can sync with any DC in the parent domain Clients sync with any DC in its own domain DCs can sync with PDC emulator in its own domain or any DC in parent Source: Microsoft Corporation

13 Time Synchronization Virtualization Issues No CPU cycles needed none given! Clock drifts can be significant in a relatively short period Idle cycles in a virtual machine is an Active Directory domain s worst enemy How do you combat time synchronization issues? More than a 28 minute drift!

14 Time Synchronization Option A Using W32Time Use Windows Time Service NOT VMware Tools Define an alternative external time source for master time server 1. Modify registry settings on the PDC emulator for the forest root domain: HKLM\System\CurrentControlSet\Services\W32Time\Parameters Change Type REG_SZ value from NT5DS to NTP Change NtpServer value from time.windows.com,0x1 to an external stratum 1 time source, i.e. tock.usno.navy.mil,0x1 HKLM\System\CurrentControlSet\Services\W32Time\Config Change AnnounceFlags REG_DWORD from 10 to 5 2. Stop and restart time service net stop w32time net start w32time 3. Manually force update w32tm /resync /rediscover

15 Time Synchronization Option B VMware Tools Modify Windows Time Service Use VMware Tools Implement Domain Controllers Group Policy to modify registry: Modify Enable ESX server NTP daemon to sync with external stratum NTP source VMware Knowledge Base ID# 1339 Use VMware Tools time synchronization within the virtual machine NOTE: VMware Tools time sync is designed to play catch-up, not slow down!

16 Time Synchronization Descheduled Time Accounting Custom VMware Tools component Tightly integrated with hypervisor Use with ESX 3.x VMs only Currently for uniprocessor Windows and Linux VMs only Improved accuracy for guest OSes CPU time accounting Allows quicker catch-up of time for guest OS Launches a VMDesched thread or process within VM s OS

17 Time Synching Descheduled Time Accounting (2) Perform a Custom installation of VMware Tools in Windows guest OS

18 Time Synchronization - Summary Use one method or the other Do NOT use both!!! Decisions should be based on current time management infrastructure or organization s policies

19 Performance Issues Virtualization Challenges

20 Performance for Virtualized Domain Controllers Virtualized AD domain controllers can run at 85-90% of native system s performance Active Directory deployments in most datacenters utilize less than 10% of today s computing power Requires significantly less hardware to achieve greater number of virtualized domain controllers Greater number of domain controllers provides better logon results, less points of failure

21 Performance Single Processor

22 Performance Dual Processors

23 Performance - Scaling Processors Up

24 Performance Summary Virtualization does not necessarily increase performance Proper planning of resource allocation is still important It s still important to follow Microsoft s best practices for the strategic placement of FSMO role servers, catalog servers, etc.

25 Virtualization Challenges Security, Network and Replication

26 Security - VM Access Control

27 Network - Connections Use the Maps view to verify network infrastructure Create separate VM port groups connected to individual NICs

28 Network - Advanced Switch Settings Vmware ESX 3.x provides some more sophisticated network settings

29 Replication - Using Replication Monitor Validating Inbound Connections

30 Security, Network & Replication Summary Utilize VMware Infrastructure 3 access policies Configure outbound virtual switches for redundancy Validate/Test for proper replication between virtualized domain controllers

31 Virtualization Challenges High Availability & Disaster Recovery/Preparedness

32 High Availability VMware ESX 3.x / vcenter Server 2.x VMware provides solutions for automatically restarting virtual machines Implement VMware HA as a high availability to ensure virtual machine domain controllers restart in the event an ESX server fails

33 High Availability VMware ESX 3.x / vcenter Server 2.x Combined with VMware DRS Anti-affinity rules can ensure domain controller VMs are segregated

34 Disaster Recovery Best Practices Perform consistent system state backups Provided by most major commercial backup software Follow Microsoft recommendations on FSMO role placement All Active Directory restorations should be performed using authoritative and non-authoritative methods Do not recover an Active Directory database from a backup copy of an old virtual disk!

35 Disaster Recovery - Scenarios Improper Restore of VM Proper Restore of VM Source: Microsoft Corporation

36 High Availability, Disaster Recovery Summary Utilize VMware DRS and HA to implement a successful recoverability solution Always to continue to use Microsoft s System State data best practices to backup AD database Default useful life of System State data days Controlled by Tombstone lifetime attribute (depends on OS, SP, etc.) Microsoft does not support snapshots of DCs KB Continue to follow best practices around the placement of key, critical roles

37 Transitioning from Physical to Virtual

38 How to you successfully migrate? Virtual machine considerations DNS configurations Best practices

39 Virtual Machine Considerations Size the VM s memory to run entire AD database in cache to avoid disk performance hits Windows 2003 Server Value 32-Bit 64-bit RAM Cache Approx. # of Users 2.75GB (using /3GB switch) 16GB 100, million

40 Virtual Machine Considerations Add, modify, search, delete and update operations will benefit significantly from caching Slight penalty incurred for write operations Physical or Virtual Microsoft s AD Sizer can help you plan the size Use Microsoft s best practices and separate boot, database, log virtual disks on individual SCSI controllers to optimize write performance

41 Transitioning from Physical to Virtual Start with a fresh system state backup for recovery Consider creating a dedicated virtual switch or virtual machine port group to isolate replication traffic Generally single processor virtual machines are adequate for domain controllers Validate inbound/outbound connections between physical and virtual machines Allow hours for replication to complete Change the weight and/or priority of the DNS SRV records for virtual machines Monitor the logon requests to ensure virtual machines are successfully responding Decommission physical domain controllers

42 DNS Modifications Transitioning to VMs Modify the weight and/or priority of the DNS SRV records Specifically offload the authentication requests from the PDC emulator when possible DNS weight is the proportional distribution of requests among DNS servers DNS priority is the likelihood a server will receive a request PDC emulators should have one or both adjusted accordingly by adding: HKLM\System\CurrentControlSet\Services\Netlogon\Parameters LdapSrvWeight DWORD decimal value of 25 or 50 HKLM\System\CurrentControlSet\Services\Netlogon\Parameters LdapSrvPriority DWORD decimal value to 100 or 200 Physical domain controllers should be adjusted similarly to decrease dependencies on PDC emulator

43 DNS Modifications Can also be changed within DNS manager Registry changes do not require a reboot

44 Best Practices Avoid snapshots or REDOs for domain controller virtual machines Do not suspend domain controller virtual machines for long periods Consistent and regular system state backups still very important Avoid physical to virtual DC conversions

45 Virtualizing Active Directory can be done!!! System State backups regularly Time Synchronization High Availability/Disaster Recovery Plan Monitor Replication Traffic Modify DNS SRV records to redirect logon authentications to VMs Go back and constantly re-evaluate your strategy!!!

46 VI OPS Portal A customizable collaboration site for sharing role and subject based proven, prescriptive, and actionable guidance. Features Approved Operational Practices Best Practices of Industry Experts Prescriptive Guidance For customers by customers Consistent appearance

47 Additional Information VMware Time Sync and Windows Time Service VMware Knowledge Base ID# Installing and Configuring NTP on VMware ESX Server VMware Knowledge Base ID# ttp://kb.vmware.com/kb/1339 VMware Descheduled Time Accounting How to detect and recover from a USN rollback in Windows Server How to detect and recover from a USN rollback in Windows 2000 Server

48 Additional Information (2) Active Directory Performance for 64-bit Versions of Windows Server A-475C-96E0-316DC821E3E7&displaylang=en Microsoft s Active Directory Sizer for Windows US/setup.exe Active Directory Performance Testing Tool (ADTest.exe) B8A4-99F98B3F4338&displaylang=en Support policy for Microsoft software running in non-microsoft hardware virtualization software How to configure an authoritative time server in Windows Server

49 Thank you!!

50

51 Thank you for coming. Rate your session and watch for the highest scores!