Recover Orphaned DC at DR
Hey techies.
Got a good one for ya... hoping some of you AD uber-geeks have come across this before. By the way, I'm the network admin, not the AD admin, though I do have my MCSE 2000, so I'm not totally unfamiliar with what I describe. The AD admin and I are a little at odds as to the outcome of this scenerio.
We are trying to set up a hot DR site, and have added a DC there which can communicate across an MPLS connection with us here at HO. At DR, we have set up exact duplicate subnets and vlans as here at HO. By the way, as we are an affiliate of a much larger organization, we are not the AD root... we connect to the root via a T1 connection to corporate head office in Kentucky. We have also set up a mirror T1 at DR so that the DR-DC will be able to see the root in the event of a disaster. So, here's the delemna:
If, whether via test or an actual disaster, the link between us and the DR site is severed, I can manually bring up the vpn tunnel over the T1 backup link. This will allow the now orphaned DC to connect to corporate and see the AD root. I suppose at that point, in the case of a real disaster, the DC could operate for a while solo, and if necessary, assume the FSMO roles.
Now, the obvious tricky one... a DR test. Picture this: I manually sever the link to HO. At DR, I bring up the T1 so the DC can be pointed to the root. The root now sees HO across the prime T1, and the orphaned DC at DR. Even worse, part of the test will be to snapshot recover a mess of servers into a vlan/subnet that is the mirror of the one here at HO. Is it possible that since the DC cannot see the domain master here at HO, it will allow domain accounts to login from the servers and Bob's your uncle?
Or, since the root can still see the HO networks and knows that the server subnet is alive and kicking back here at HO, will the root cause the orphaned DC to not authenticate the rebuilt servers and domain accounts?
Any insights and/or links greatly appreciated.
Mike