How to set up domain controllers when migrating to a virtualized environment.

i converting about 25 servers in 1 forest 2 domains hyper-v guest vms, spread out across 9 physical hosts.

i have read risks of relying on virtual machine dc's have not found a thorough discussion of best practices, regarding both domains vms belong , how configure dcs physical hosts themselves.  looking @ having the hosts on own separate domain.

this issue must have received lot attention -- can point me reference, 1 considers costs , benefits of have dedicated physical machines dcs?

do enhancements hyper-v 2012 affect recommendation to host adds on physical server?

yes , no.

so, active directory virtualization safeguards, make virtual domain controller less susciptible unwanted changes virtualization platform , virtualization admins. basically, virtual windows server 2012 (r2)-based domain controller can detect when reverted previous snapshot, when unsupportedly restored backup , when virtual hard disk being reused virtual machine. uses vm-generationid capabilities of hypervisor platform (when available).

this, in not solve chicken-and-egg problem virtualizing domain controllers in active directory environments windows server 2003 (r2) , windows server 2008 (r2) domain controllers , hyper-v failover clustering. windows server 2012 clustering bootstrap feature does, however, in failover cluster scenario.

for other scenarios, challenge remains. in case of disaster recovery, having physical domain controller available troubleshoot problems with hyper-v hosts, backup, etc. helps. however, not imply domain controller has be physical. can run on separate virtualization platform, can run non-ha or may restorable fast.

also, not imply hyper-v hosts members of same active directory domain virtual domain controllers, other member servers, devices , colleagues. in many (large) implementations, hyper-v hosts members of separate active directory forest.

more information:

new features in ad ds in windows server 2012, part 12: virtualization-safe active directory 
new features in ad ds in windows server 2012, part 13: domain controller cloning 
preventing domain controller promotions, cloning , demotions in windows server 2012 
cases vm-generationid doesn’t make active directory virtualization-safe, part 1
cases vm-generationid doesn’t make active directory virtualization-safe, part 2

how sufficient have secondary dc on physical hardware instead of primary, vm?

it depends.

the recommendation refering apply to windows server 2003, windows server 2008 , windows server 2008 r2. these windows server versions not have active directory virtualization safeguards find in windows server 2012 , up.

the domain controller holding pimary domain controller emulator (pdce) flexible single master operations (fsmo) role, is, in documentation, referred ad primary domain controller. fsmo role makes domain controller in charge of time synchronization (through time hierarchy), password changes, group policy changes and, in cases authentication through pdc chaining. part of best practices on fsmo placement is host schema master fsmo role on pdc well. makes pdc in charge of schema updates.

for many dr purposes, or hyper-v hosts won't need access pdce or schema master fsmo roles.

Windows Server  >  Hyper-V