I'm on the verge of getting down to a single (UnRAID) server.  All that's left to solve/replace is Active Directory.

I know it's possible to do with OpenLDAP, but it seems like a rare and scarcely documented use case - I'm nervous about going that route.

Instead, I'm considering just building a new Domain on a Windows 2022 VM and retiring my current 2012R2 PDC.  (I understand the headaches of moving to a new domain, but I'm prepared.)

Can I expect trouble if UnRAID is joined to a Domain that's only available in a nested VM?  I had some really bad behavior when I had a network issue - I couldn't even log into the console - I'm afraid that I could end up in a similar situation by doing this.

Thanks in advance for your ideas and experience!

Expect to see a lot of troubles.

 

What you are about to create is a "chicken & egg" problem what we call it over here.

 

The VMs (and Dockers) are started last on UNRAID, but the shares start before already. Without a running DC there may be enormous delays in many (even unexpected) situations.

Remember, once you turn off the UNRAID array, VMs and Dockers are stopped too again, so disk maintanence can become very cumbersome too.

 

Even logins to the webgui may be affected by this.

 

So I would say: AVOID, AVOID, AVOID!

 

Edited June 12, 20242 yr by MAM59

2 hours ago, MAM59 said:

 

So I would say: AVOID, AVOID, AVOID!

 

Thanks... this is really what I was kind of expecting.  I had hopes that maybe UnRAID had a credential caching mechanism to deal with this.

I think it's strange that there seems to be so little overlap between UnRAID and AD - it's incredibly useful in a mutli-child, multi-computer family.

It seems like there may only be two decent options:

  1) Keep a domain controller offline, and boot it whenever I run into a problem.
  2) Figure out the OpenLDAP thing. 
      (the documentation I've found is really lacking, and it seems like I could run into the same sort of problem if Docker doesn't start.)

If anyone has suggestions (or can point me to a good OpenLDAP resource), I'd be grateful.

5 minutes ago, bithoarder said:

1) Keep a domain controller offline, and boot it whenever I run into a problem.

It wont help you if it is offline. Credentials are checked all the times.

6 minutes ago, bithoarder said:

2) Figure out the OpenLDAP thing. 

No idea about this one, sorry. And I guess, it does not cover full AD capabilities.

 

I have lived with a very small DC for some years, a 15W machine, just for PDC. I guess, with today's hardware (N-100 or something) you could even save more electricity). Finally I dropped AD completly, because there were only few clients left, no need anymore for centralized management. Therefor my infos may be a bit outdated by now, but the AVOID warning is still valid.

 

On 6/12/2024 at 8:01 AM, MAM59 said:

It wont help you if it is offline. Credentials are checked all the times.

 

Thanks for the input... I didn't get a notification, so I'm just seeing it now.

My idea here was to have a second DC as "backup".  One could run on a VM, and I'd turn on the second machine only when there was a problem.

I'm still kicking ideas around... a low power computer running Windows might be the way to go.