How to configure ADS Failover
search cancel

How to configure ADS Failover


Article ID: 136046


Updated On:


CA Identity Manager CA Identity Governance CA Identity Portal CA Identity Suite


You can configure the Active Directory connector to fail over to alternative Active Directory servers. This is useful when multiple domain controllers serve a single Windows domain.


The process and prerequisites are discussed in full detail in the Connector documentation (see link below), this information augments the documentation.


All Identity Manager


Documentation Clarification


There are some pre-requisites to making this work which are fully documented, but in summary:


1. More than one domain controller must exist in the environment

2. Ensure that the name of the Active Directory server that is specified on the Endpoint page matches its fully qualified DNS name.

3. If you are using SSL, ensure that all of the domain controllers in the domain are configured to use SSL.

4. The "ADS_FAILOVER" system environment variable must be set to 1 on the machines which are running the C++ Connector Server and the Provisioning Manager

5. After these settings are applied the Connector server (CCS) requires a restart.


Once you have met the pre-requisites log on to the Provisioning Manager and follow the steps below.


1. Click on "Endpoints" icon at the top of the screen.

2. in the Object type: Select "Active Directory Endpoint"

3. Click "Search"

4. The name of your endpoint should appear in the left hand pane.  Double click and you will see the Endpoint properties.

5. Click on the "Failover" tab. (This only appears if you have more than 1 DC in your environment)

6. Ensure that "Failover to the first available backup controller" is ticked.


For example:



7. Click on "Refresh DC list" to get a list of the Backup Domain Controllers (DCs).  This information is propagated from DNS.  


For example:


8. Click "Apply".

9. Now click on the "Users" icon and click on the search button.

10. Select a user and double click to display their properties. 

11.  Click on the "ADS Domain Preferences"  tab and you will now see the DCs added to the preference list, from here you can set the preference order.

12. Click "Apply" to make any changes.


Additional Information

How to change the ADS Endpoints hostname and/or clear the failover list of DCs when a DC is decommissioned