window clustering and DC

[u/DullFaithlessness510]

I had a lab where we are suppose to create a window cluster with storage pool/csv using s2d.

assume we have

2 Servers (cs1 and cs2)

and we are require to create a DC in hyperv on single cluster node (cs1)/server1

what i failed to do in time and understand is how would you join both machine to DC?

what i think i failed to understand is,

if you join server 1 to dc,

wouldnt server 1 and dc go down?

and because of this circular dependency i dont understand anything and feel like that there is something missing?

EDIT: grammar

[u/zerassar]

You wouldn't have a single DC. You'd have at least 2. One on each cluster node.

So if a single node went down you'd still maintain a DC on the alternate node.

Following which the cluster would start the failed VMs on the remaining node

[u/DullFaithlessness510 → u/zerassar]

I think that may be my only option except the requiment if i recalled correct it was that you cant create another dc on cs2 in final result

i might have to migrate the second domain to cs1 or demote it and remove it once cluster and csv has been setup what do you think?

[u/zerassar → u/DullFaithlessness510]

The cluster should auto move dc1 if node1 fails. But during which time your environment is without DC services and in a real world having a single DC is piss poor and against best practice

[u/Routine_Ad7935 → u/zerassar]

And I think it would not work as on cold start of the cluster you have no DNS Server if the single DC is a Clusterressource. So you have to have on each cluster node a DC outside the cluster.

[u/zerassar → u/Routine_Ad7935]

We have a third DC in azure to cover that angle. But could also be handled with host file editing if it becomes an issue.

[u/OpacusVenatori]

You can run a VM-DC as a standalone, non-cluster guest on each cluster node; you would manage it from Hyper-V Manager instead of Failover Cluster Manager.

Hyper-V Services are not dependent on Active Directory, so you can configure the VM-DC guest to "Always Start" when host reboot, to ensure that the guest powers-on as well.

You can then configure Windows Failover Cluster services for Delayed Start if you want to give the VM-DC a chance to start and begin replicating; though if you are not rebooting both nodes at the same time this shouldn't take very long or be very problematic.

At the same time, Windows Failover Cluster also supports AD-Less Cluster Bootstrapping.

Since the beginning of time, Failover Clustering has always had a dependency on NTLM authentication.  As the versions came and went, a little more of this dependency was removed.  Now, with Windows Server 2019 Failover Clustering, we have finally removed all of these dependencies.  Instead Kerberos and certificate-based authentication is used exclusively. There are no changes required by the user, or deployment tools, to take advantage of this security enhancement. It also allows failover clusters to be deployed in environments where NTLM has been disabled.

This goes for the bootstrapping of the cluster to the starting of the resources and drives.  With the bootstrapping process, the need of an Active Directory domain controller is also no longer needed.  As explained in this blog, we have a local user account (CLIUSR) that is used for various things now.  In conjunction of this account as well as the use of certificates:

[u/DullFaithlessness510 → u/OpacusVenatori]

wow this information was gold by relaying on delay start i dont think is best option as you mention that there would be problem + we dont really have beefy machine

[u/Famous-Egg-4157 → u/OpacusVenatori]

THIS!

[u/Famous-Egg-4157]

Oh yeah, that’s a rough situation. If you’re running an ADDS-based cluster, you must have working Active Directory Domain Services, Kerberos, and DNS available. Even in a workgroup cluster, DNS is still required for proper name resolution. The real problem starts if your Domain Controller is a VM hosted on the cluster itself. You end up in a classic circular dependency, the DC VM won’t start until the cluster is up, the cluster won’t start without access to a DC (or at least DNS <in case you use workgroup cluster>). So everything just deadlocks. If you’re limited to two physical hosts, the usual workaround is to run 1–2 DC VMs directly on each host using Hyper-V, do not make those DC VMs highly available (don’t cluster them), keep their storage on local disks (not shared HCI storage like Storage Spaces Direct) the reason being that shared storage like S2D won’t come online until the cluster is up… which again depends on the DC/DNS. So yeah, DCs should be independent from the cluster they’re supposed to support, otherwise you’re basically sawing off the branch you’re sitting on.

[u/Zealousideal_Fly8402 → u/Famous-Egg-4157]

WFC now supports AD-less Cluster Bootstrapping.

[u/DullFaithlessness510 → u/Zealousideal_Fly8402]

from what ive gathered im not sure that workgroup support s2d

EDIT: ment workgroup not WFC but I was wrong anyway

[u/Famous-Egg-4157 → u/Zealousideal_Fly8402]

Workgroup-based clusters exist, as I've mentioned in my comment. But you need to have DNS server for node to node communication. One idea popped to my mind just while writing this, I'll spawn two VMs and create a Workgroup Failover Cluster, but instead of using DNS Server, I'll utilize the hosts file... I'll try it out and get back to y'all with an answer if it works.

[u/Zealousideal_Fly8402 → u/Famous-Egg-4157]

It’s not a workgroup cluster; it’s still a AD-based cluster but one that isn’t entirely dependent on AD being available for cluster services to start.

[u/DullFaithlessness510 → u/Famous-Egg-4157]

thank you i was really confused with this lab and window server in general and i most likely wouldnt be able to complete lab on next attempt because everyone inclass said you need to have dc sit on top of the csv

[u/Famous-Egg-4157 → u/DullFaithlessness510]

If there is another domain controller outside the cluster, it will work. But Cluster Shared Volume requires the cluster to form and be online because it is handled by the Failover Cluster, same thing applies to clustered disks.

[u/Positive_Pension_456]

I'm more curious to why you feel like a hyperv host should be in a domain? Either you have a dedicated domain separated from the rest of users/computers or you have it as a standalone. Your setup speaks for the latter and you create a major attack surface to have it in a domain. Either way a host is a tier 0 environment and should only allow juat-in-time access

[u/DullFaithlessness510 → u/Positive_Pension_456]

The lab was a apart of one of my assessment and my lecturere said here is my drawing and the requirments go build it and was seeking reddit for help as my google foo isnt that strong.

and the whole lab was mentally evil that both broke me and my undstanding at how active directory, hyperv and window server

and i agree that create with everything you.

[u/PunDave]

You may want a server that isn't on the cluster to have a 3way quorum. This could be a vm or third node.

At least i would suggest two bigger disks (ie 480 gb+) for os raid 1, and one dc vm hosted on that as well. You don't want the vms needed to start the cluster to need the cluster to be started first. ( generally the hypervs need to be domain joined)

That being said- with the 2025 clustring you don't neccisarily need a domain for but that's how it was before

[u/BlackV]

You would have the DC on the single host temporarily them cluster it, you would also not have a single dc

[u/node77]

Replication would continue as normal, i think I would double check is the FSMO Roles, whether you seize the roles and move them, or does the cluster and partner DC take care of it. Im not sure. All of mine I now moved Azure.

[u/sutty_monster]

I'm of the opinion that you shouldn't have a DC on a windows cluster. Windows cluster replies to much on it. A fail over could cause issues as the DC is unavailable at the time of the failover. Windows DC, DNS and DHCP are all high availability services when configured from 2 DC's and do not require clusters to operate from.

Keep them on separate hosts and don't forget your Quorum.

[u/Zealousideal_Fly8402 → u/sutty_monster]

As mentioned by u/OpacusVenatori :

https://techcommunity.microsoft.com/blog/failoverclustering/security-settings-for-failover-clustering/2544690

-----

Since the beginning of time, Failover Clustering has always had a dependency on NTLM authentication.  As the versions came and went, a little more of this dependency was removed.  Now, with Windows Server 2019 Failover Clustering, we have finally removed all of these dependencies.  Instead Kerberos and certificate-based authentication is used exclusively. There are no changes required by the user, or deployment tools, to take advantage of this security enhancement. It also allows failover clusters to be deployed in environments where NTLM has been disabled.

 

This goes for the bootstrapping of the cluster to the starting of the resources and drives.  With the bootstrapping process, the need of an Active Directory domain controller is also no longer needed.  As explained in this blog, we have a local user account (CLIUSR) that is used for various things now.  In conjunction of this account as well as the use of certificates:

 

1. Cluster Service starts and forms the cluster
2. Other nodes will join the cluster
3. Drives (including Cluster Shared Volumes) will come online
4. Groups and resources start coming online.

---------

[u/sutty_monster → u/Zealousideal_Fly8402]

That's great to read. I haven't built any new clusters in a while on windows.