Active Directory Operating Procedures

Regular checks

Verify both domain controllers answer domain DNS and LDAP service discovery queries. Check Samba AD replication status and FSMO ownership. Confirm Kerberos and time synchronization remain healthy.

SYSVOL

Review the sysvol-sync.timer and sysvol-sync.service on ad-1. Confirm successful runs, then compare policy contents and permissions between ad-1 and ad-2. AD database replication alone does not synchronize SYSVOL.

Linux joins

Use realm list to inspect domain membership and SSSD logs to diagnose lookups. Verify domain user and group resolution with a designated test account. Unprivileged LXC ID mapping may prevent a successful user switch even when directory lookup succeeds.

Maintenance

Maintain one controller at a time. Check DNS and replication before changes and recheck DNS, replication, authentication, time and SYSVOL afterward.

Recovery

Keep Samba-aware backups, a record of FSMO ownership, SYSVOL synchronization configuration, and emergency console access. Do not restore an old domain controller VM snapshot into a functioning multi-DC domain without a supported recovery plan.