Also name things so they're a little more obvious.
someone would inevitably restart the wrong one from the VM host, thinking it was the one they'd been SSHing to :/
Though we did, in the same mess of network, have dc01-<domain> and dc02-<domain>.
dc01 was the Domain Controller.
dc02 was... The backup of ad01-<domain>...
And a page in the documentation.