[Samba] Samba 4 AD BDC (Syncrepl)

[basti]

Hello,

at the Moment we use and Samba 4 in NT4-style Domain with approx. 20
Clients.

With the Problem of Windows 10 to join to NT4-style
(https://wiki.samba.org/index.php/Required_Settings_for_Samba_NT4_Domains#Windows_10:_There_Are_Currently_No_Logon_Servers_Available_to_Service_the_Logon_Request)
we plan to migrate to Samba AD.

At the Moment there is the following scheme:

samba PDC (Fileserver) -> Openldap syncrepl to Mailserver (to receive
mails if PDC is down)

As I can read Samba LDAP can't sync to OpenLDAP and it's not recomment
to run PDC on Fileserver.

What is the best way?

samba PDC (kvm vm/ host1) <- drs -> Samba BDC (kvm vm/ host2)

Fileserver, get users via pam_ldap from PDC.
Mailserver, get users via pam_ldap from PDC.

How does the mailserver know to ask the bdc if pdc is down?

Or should I place the bdc on mailserver?


Best Regards,
Basti