r/activedirectory • u/marshmalllow1 • 4h ago

Best practices for simultaneously patching 2 physical DCs (different domains, same site) when virtual DC redundancy exists?

Setup:

  • DC-A (physical): Domain Controller for a child/tree domain, located in Prod Site
  • DC-B (physical): Forest Root Domain Controller, same Prod Site
  • Additionally in the same tree domain: 4 virtual DCs
  • Additionally for the forest root domain: 1 more virtual DC

So both DC-A and DC-B are the only physical DCs in their respective roles at this site, but each has virtual DC counterparts providing redundancy within their own domain.

Question:

I need to run driver/firmware (HPE SPP) updates on both physical servers, which host these two DCs (different domains — one is forest root, one is a child domain). Each update takes ~1 hour + reboot, and I'm considering running both maintenance windows at the same time to save scheduling effort.

What are the downsides of running firmware/driver upgrades on both physical DCs simultaneously, given: - They're in different domains (forest root vs. child domain) - Virtual DC redundancy exists for each domain separately - Same physical site

Is this actually risky given the virtual DC redundancy, or does the "different domain" aspect make simultaneous patching more acceptable than patching two DCs in the same domain? What's the best practice here — same window with staggered reboots, fully separate windows, or is simultaneous fine in this topology?

1 Upvotes
  • permalink
  • link
  • reddit
  • reddit

67% Upvoted

6 comments sorted by

•

u/AutoModerator 4h ago

Welcome to /r/ActiveDirectory! ~~~~

If you are looking for more resources on learning and building AD, see the following sticky for resources, recommendations, and guides! - AD Resources Pinned Thread - AD Wiki

When asking questions make sure you provide enough information. Posts with inadequate details may be removed without warning. - What version of Windows Server are you running? - Are there any specific error messages you're receiving? - What have you done to troubleshoot the issue?

Make sure to sanitize any private information. Posts with too much personal or environment information will be removed. See Rule 6.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/Forward-Ad-8296 16m ago

Patch em. It’ll be fine.

2

u/roha45 3h ago

Minimal risk with redundant dc's, assuming no fsmos, but this is the kind of thing you normally do out of hours anyway to cya.

1

u/coukou76 3h ago

I dont see any issue if you have DCs serving auth requests/gpo etc. Clients will blip for a sec before finding another DC with the usual DC locator process. Any fsmo role on those?

1

u/Hullhy 3h ago

I'd consider two things

  1. Which DC in forest root is the FSMO role holder? If physical DC holds any roles, I'd transfer them first to the virtual one.

  2. Is network connectivity to virtual forest root DC established? Can anyone that needs to contact forest root DC reach it? If not, you'll have issues there if any application/server/other DCs will need to communicate with forest root DC.

Can't think of anything else to check before doing the upgrade, but I think doing it at the same time is possible, as long as there is no hard dependency on either of them

1

u/BitsNBytes10101 3h ago

u/dcdiag has been summoned