Force BCAAA to connect to a specific domain controller
search cancel

Force BCAAA to connect to a specific domain controller

book

Article ID: 165842

calendar_today

Updated On:

Products

ProxySG Software - SGOS

Issue/Introduction

For multiple domain controllers in a given domain, if sites and services are not configured for a given site, any Windows workstation creates a secure channel with a random domain controller in the domain.
This may introduce latency if the domain controller is across the WAN.
To minimize the impact on logons you want to establish BCAAA secure channels to specific domain controllers.

Resolution

To establish a secure connection from BCAAA to a specific domain controller, you must use the nltest.exe utility.

The nltest.exe utility from Microsoft  is a part of Windows Remote Server Administration tools.  To install the Remote Server Adminstration tools, follow the instructions here:

https://learn.microsoft.com/en-us/troubleshoot/windows-server/system-management-components/remote-server-administration-tools

For a list of all the available command line parameters, please run nltest /? from the command line. For more information see:  NLTEST

Steps to bind BCAAA to a specific domain controller

  1. The nltest.exe utility must be installed on the Windows workstation or server hosting the BCAAA agent. 
  2. Using nltest display which domain controller that the secure channel BCAA is currently connected:
    • nltest /sc_query:<domain name>
  3. Find all of the available domain controllers by hostname:
    • nltest /dclist:<domain name>
  4. Select a domain controller (DC) from the list and force the secure channel to the desired DC:
    • nltest /sc_reset:<domain name>\dcname

The secure channel selection is not persistent across reboots. The secure channel will reset when the Windows server is rebooted.   If you want to force the BCAAA server to bind to a particular server after a reboot, create a Windows startup which includes the "nltest /sc_reset:<domain name>\dcname" command to bind to a specific DC.