The Number of Slave KDCs
Slave KDCs generate credentials for clients just as the master KDC does. Slave
KDCs provide backup if the master becomes unavailable. Each realm should have at
least one slave KDC. Additional slave KDCs might be required, depending on these
The number of physical segments in the realm. Normally, the network should be set up so that each segment can function, at least minimally, without the rest of the realm. To do so, a KDC must be accessible from each segment. The KDC in this instance could be either a master or a slave.
The number of clients in the realm. By adding more slave KDC servers, you can reduce the load on the current servers.
It is possible to add too many slave KDCs. Remember that the
KDC database must be propagated to each server, so the more KDC servers
that are installed, the longer it can take to get the data updated
throughout the realm. Also, because each slave retains a copy of the KDC
database, more slaves increase the risk of a security breach.
In addition, one or more slave KDCs can easily be configured to
be swapped with the master KDC. The advantage of configuring at least one
slave KDC in this way is that if the master KDC fails for
any reason, you will have a system preconfigured that will be easy to
swap as the master KDC. For instructions on how to configure a swappable
slave KDC, see Swapping a Master KDC and a Slave KDC.