Recipe 3.17 Enabling and Disabling the Global Catalog

3.17.1 Problem

You want to enable or disable the global catalog on a particular server.

3.17.2 Solution

3.17.2.1 Using a graphical user interface

1. Open the Active Directory Sites and Services snap-in.

2. Browse to the nTDSDSA object (NTDS Settings) underneath the server object for the domain controller you want to enable or disable the global catalog for.

3. Right-click on NTDS Settings and select Properties.

4. Under the General tab, check (to enable) or uncheck (to disable) the box beside Global Catalog.

5. Click OK.

3.17.2.2 Using a command-line interface

In the following command, <ServerObjectDN> should be the server object DN, not the DN of the nTDSDSA object.

> dsmod server "<ServerObjectDN>" -isgc yes|no

For example, the following command will enable the global catalog on dc1 in the Raleigh site:

> dsmod server[RETURN]  "cn=DC1,cn=servers,cn=Raleigh,cn=sites,cn=configuration,dc=rallencorp,dc=com" -isgc[RETURN] yes

3.17.2.3 Using VBScript

' This code enables or disables the GC for the specified DC ' ------ SCRIPT CONFIGURATION ------ strDC = "<DomainControllerName>"   ' e.g. dc01.rallencorp.com strGCEnable = 1                    ' 1 = enable, 0 = disable ' ------ END CONFIGURATION --------- set objRootDSE = GetObject("LDAP://" & strDC & "/RootDSE") objNTDS = GetObject("LDAP://" & strDC & "/" &  _                     objRootDSE.Get("dSServiceName")) objNTDS.Put "options", strGCEnable objNTDS.SetInfo

3.17.3 Discussion

The first domain controller promoted into a forest is by default also made a global catalog server. If you want additional servers to have the global catalog, you have to enable it. The global catalog on a domain controller becomes enabled when the low-order bit on the options attribute on the nTDSDSA object under the server object for the domain controller is set to 1. The DN of this object for dc1 in the Default-First-Site-Name site looks like this: cn=NTDSSettings,cn=DC1,cn=Default-First-Site-Name,cn=Sites,cn=Configuration,dc=rallencorp,dc=com.

After enabling the global catalog, it can take some time before the domain controller can start serving as a global catalog server. The length of time is based on the amount of data that needs to replicate and the type of connectivity between the domain controller's replication partners. After replication is complete, you should see Event 1119 in the Directory Services log stating the server is advertising itself as a global catalog. At that point you should also be able to perform LDAP queries against port 3268 on that server. See Recipe 3.18 for more information on how to determine if global catalog promotion is complete.

3.17.4 See Also

Recipe 3.18 for determining if global catalog promotion is complete, and MS KB 313994 (HOW TO: Create or Move a Global Catalog in Windows 2000)