Brian Blogs on SharePoint

Information, curiosities, and observations about SharePoint and the community.

SharePoint on a Domain Controller

Posted by Brian Gough on July 16, 2009

Many of you that have been in the SharePoint world know that it is not recommended to install SharePoint on your Domain Controller. I recently had to compile a list of the reasons WHY this is a bad thing to educate and inform a client. Well, maybe my choice of search terms was poor, but it was not an easy thing to find a list of the issues/concerns around loading SharePoint on a DC. Many folks have mentioned it in their blogs, but most just say ‘Microsoft does not recommend it’, so they also say don’t do it. I would really like to know WHY. Exactly what is the problem with doing this? What I have done is compiled a list from a myriad of sources to try and have a more complete reference for reasons why you should not do this. Now, many of us do this in our test/dev, VM’s or sandbox set ups that we use for demos, presentations etc. and I that is fine. This is more geared towards production environments.

Here is what I put together. If you have any additional facts that support this, please let me know. Also, just as important, if you have concrete facts that dispute anything here, I would love to have that as well. I broke out the list in two sections, A) SQL Server related, B) SharePoint related

Issues with Installing SQL Server on a Domain Controller

  • Running SQL Server on a domain controller is a security risk. With both running on the
    same physical server, should one of them be compromised, then it is possible that it might be easier to compromise the other one also.
  • Reporting Services on a domain controller requires manual configuration after setup, and it seems that some folks have had problems and the manual set up does not work 100% of the time.
  • You cannot run SQL Server services on a domain controller under a local service account or a network service account.
  • After SQL Server is installed on a computer, you cannot change the computer from a domain controller to a domain member. You must uninstall SQL Server before you change the host computer to a domain member.
  • SQL Server failover cluster instances are not supported where cluster nodes are domain controllers. This could seriously impede any future growth for scaling out.
  • SQL Server is not supported on a read-only domain controller.
  • You’ll never be able to move that SQL Server into another domain
  • You are mixing an “application sever” with a “file server” so scripts and such become a concern. You might end up getting severe performance and stability issues on both SQL Server and ADS. Applying a service pack might want a reboot – and then nobody can log on at all, not even those who don’t use SQL Server, unless you have a BDC ( Backup Domain Controller ).

Issues with installing SharePoint on a Domain Controller

  • When installed onto a member server (i.e not a Domain Controller), SharePoint creates a several local security groups. This is not unusual at all, as SQL Server does the same thing. But on a domain controller, there are no local security groups – just domain groups. Thus, the SharePoint installer figures out that it is running on a Domain Controller and changes the behavior of the creation of those groups. Normally on a member server, a SharePoint Installation would create three local groups, however, in a domain controller environment, these local groups are not created because there is no concept of local security accounts. Accounts get created in Active Directory instead.
  • Service Packs, Infrastructure updates, hot fixes and the like all require the SharePoint Technologies wizard to be re-run on every server in the farm. The wizard *assumes* that the local WSS_* groups already exist and that certain permissions are already in place. Being on a Domain Controller can have unexpected results.
  • Reporting Services and other wizards run expecting local services which do not exist on a DC.
  • You will not be able to use Document Conversion at all. There is no work around or a resolution to this.

 
 

Resources:

http://kbalertz.com/970612/Sharepoint-supportability-Domain-controllers.aspx

http://www.cleverworkarounds.com/2008/09/16/sometimes-microsoft-bashing-is-justified/

http://www.eggheadcafe.com/conversation.aspx?messageid=32854786&threadid=32842085


 Hope this helps some of you.

 

Brian

 

About these ads

6 Responses to “SharePoint on a Domain Controller”

  1. Gonzalo said

    I’m not certain where you’re getting your information, but
    great topic. I must spend a while studying more or
    working out more. Thank you for wonderful information I used
    to be in search of this info for my mission.

  2. Excellent goods from you, man. I’ve understand your stuff previous to and you’re just extremely
    fantastic. I really like what you have acquired here, certainly like what you
    are saying and the way in which you say it. You make it entertaining and you still take care of to keep it wise.
    I cant wait to read much more from you. This is actually a wonderful
    site.

  3. An outstanding share! I have just forwarded this onto a co-worker who had been conducting a little homework on this.
    And he in fact ordered me breakfast because I found it for him…
    lol. So let me reword this…. Thank YOU for the meal!!
    But yeah, thanx for spending time to talk about this topic here on
    your site.

  4. Woundology said

    This post is worth everyone’s attention. Where can I find out
    more?

  5. This piece of writing is truly a good one it helps new web visitors, who are wishing for blogging.

  6. Warner said

    You should be a part of a contest for one of the most useful sites on the
    web. I most certainly will highly recommend this website!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
Follow

Get every new post delivered to your Inbox.

%d bloggers like this: