One Domain or Two?

[Paid_Peanuts]

I am currently investigating our AD setup. Now although we run a native 2003 domain our implementation leaves somewhat to be desired.
We currently have two separate domains, one for curriculum and the other for admin.
Over time these two domains have overlapped to the point where it is becoming an absolute nightmare to support. We have staff with unrestricted access to the machines – not locked down via GPO at all.

I want to scrap both domains and consolidate into one domain for both admin and curriculum.

Has or does anyone else run just the one domain within a secondary?

[kerrymoralee9280]

Yeah, we migrated to one domain about 3 years ago and I have to say it's worth the time planning/doing! It has just made life that bit easier.

[webman]

Same here. We're a single integrated CC3 domain.

[Jon]

The only reason I can see for having two domains would be if you require seperate password policys. If not then one domain should be the way to go.

[elsiegee40]

As above - passwords... We have tinies (aged 4) who require very simple passwords and you can only have 1 pasword policy in the domain.

To enforce a more complex policy for staff would require a second domain.

[Domino]

surely you could have a simple password policy at a domain level and make it more complex at an OU level?

Not that I've tried, just thought that it would be possible

[sidewinder]

^ Its not possible unfortunatly

I suppose it makes sense in terms of business but its quite an annoying restriction in education

[BKGarry]

Go for one domain, we did it over 2 years ago, but items like SIMS require staff to be local administrators of the machine (not domain) because of SOLUS, there is no real reason for 2 seperate domains anymore, More than likely you share the same email server, ISA/Proxy server, and even (on most counts) the same switches.

Just make sure you keep your old DC for the secondary domain to one side for a while, just in case you need anything off it, and i mean at least one year as you will find something needs to be used right at the last minute.

Gaz

[binky]

use RM Password Plus, it will work on vanilla networks.

[webman]

BKGarry: There must be a better way. None of our staff need local admin rights for SIMS.

[tarquel]

Running two physically seperated networks, and domains - one admin, one curriculum.

Mainly down to how the networks have been for the past 10 years.

The roles are starting to intermingle a bit, so maybe a trust between the networks would help there.

Regards
Nath

[Domino]

@webman: really? thats strange,

capita have always told us that was the case.

I know the upgrades don't run if they're not local admins, and I'm sure part of the profiles module require it too.....

[alonebfg]

I would have thought that the data protection issues and with the older kids always trying to Hack ect ect two domains is always a safer option I know some schools in my area have been told got to have two also i know swgfl does not let us use one there are two address ranges for us.

[dave-a]

At present we run two domains, one for teachers and pupils and one for admin staff. But this summer we are switching to just one domain for all staff and also dropping viglen classlink which we have been using for the last five years and going for a vanilla 2003 network.

[GrumbleDook]

A single domain here too ... we moved just on 2 years ago to make the most of Server 2003 and get everybody on board for SIMS.

As for security ... it is only as secure as the stupidest user ... but that is the same with any system and we just try to take the most reasonable measures we can.