Need another domain controller?

[snootalope]

Hello

We're not a huge shop here but we do have about 20 servers and 80+ dumb terminals/thin clients.

At the moment we have two domain controllers up and running. Both in the same subnet sitting right next to each other. Recently, things have began to kind of slow down from time to time and I'm seeing this error show up on alot of the servers:

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1110
Date: 10/3/2006
Time: 8:15:01 AM
User: NT AUTHORITY\SYSTEM
Computer: F1
Description:
Attempt to determine whether user and machine accounts are in the same forest failed (There are currently no logon servers available to service the logon request. ).

I'm trying to decide if it's nessacary to add another domain controller..?? Any advice??

 

[LWComputingMVP]

No, for 20 servers, 2 DCs is fine. Are there any Kerberos Event 7s?

From

http://www.eventid.net:

I found that this error was related to EventID 7 from source Kerberos. In spite of what Microsoft says about this Kerberos error, the domain controller was not down. Running nltest.exe on the domain controller also found no problems. What appears to have caused the problem was a policy setting in Group policy objects. If in either the domain controller policy or the domain policy - Security Settings -> Local policies -> Security options, "Domain Member: Digitally encrypt or sign secure channel (always)" is enabled, it will cause this problem. If you disable this policy in both areas, this problem will go away. (Note: it may take up to 2 hours to notice if it has taken).

 

[snootalope]

no.. no kerberos errors. I'll disable that "Digitally enncrypt or sign secure channel (always)" and see what that does, but it was already set to "Not Configured"

Everyhing on the server this error shows up on seems to freeze up for a minute or two when this happens. It's almost like it's losing it's network connection for a moment. I'll try and get more info..

thanks

 

[LWComputingMVP]

2 domain controllers should be able to easily handle 20 servers (thin clients don't count - but even if they did, again, EASILY handle 100 clients. I had 3 DCs (2 at the main site with 400 PCs + 30 servers, and 1 at the secondary site with 200 PCs + 5 servers (and throw another 400 Macs and Linux machines that occasionally authenticated against AD for file sharing) and no problems whatsoever.

 

[snootalope]

yeah.. I figured that 2 should be plenty but that error following strange network slow downs just kind of gave me the idea that the two might not be able to keep up.

netdiag returns no errors at all and the AD event log on the DC's isn't showing nothing but normal behaviour.

maybe I'm just getting a litle paranoid..