New 2012 Domain Name

[Wirral_Wonderer]

I am planning to re-build our domain as it is in a real mess.

 

There seems to be a lot of debate on the naming convention for a new AD.

 

Currently it is school.local, however I am thinking of using just our external FQDN school.com or int.school.com (M$ best practice)

 

I fully understand that just using our external domain name will cause issues for users trying to get to our website without using the www. first, however THIS LINK seems to provide an answer.

 

We currently have a couple of servers published, Moodle and Remote Desktop (2012), under our external domain name and our internal DNS route them without any issues.

 

Does working towards SSO for office 365 make any difference?

[Michael]

Personally I'd name it schoolname.pri or schoolname.sec for example. Avoid .local

 

Although naming it the same as your website is tempting, as you say it doesn't actually achieve anything.

[localzuk]

I'd go with your first thought - a new subdomain on your existing FQDN. If I were doing it here I'd use internal.school.county.sch.uk.

 

One of the reasons for this is down to getting SSL certificates. You won't be able to buy proper SSL certs for fake domain names any more I don't think, as the industry stopped that practice a while ago.

[Callum]

We use schoolname.edu for our internal domain.

[localzuk]

We use schoolname.edu for our internal domain.

 

Is that not risky, as that name could actually exist in the wild? (ie. .edu is a valid TLD)

[sted]

i wouldnt use .local ypads and apples in general can be a bit funny about this. New domains ive started in the last few years have all been .internal

[synaesthesia]

All .internal here. Simple, works, safe.

[Wirral_Wonderer]

Thanks so far

 

int.school.com is looking the favourite so far.

 

Do we need to do anything special to get the usernames to work under [email protected] rather than [email protected]?

[abillybob]

.internal here

[Callum]

It didn't exist at the time of creating the domain, and still doesn't exist. Even so, what are the chances of needing to access that specific site from within the domain? We didn't use .local as it causes issues when used with Apple devices.

[pete]

AD Domains & Trusts > Action > Properties > UPN Suffixes - add the suffix you want.

 

Then bulk modify user accounts to change the UPN suffix (can do in ADUC on a per-OU basis by just selecting a bunch of users > properties > Account tab) or AdModify/Powershell/whatever).

 

and a ++ for subdomain.domain.com.

[Alis_Klar]

+1 think using school.county.sch.uk is better than school.com as school name might change.

 

See Best practices for configuring a new Active Directory for some more info as to why making up your own TLD is not good.

 

AD domain names ending with ".local" are a nuisance, and ".lan" might be officially used as a gTLD in the future.

 

ISO Standard 3166 reserves the country codes AA, QM-QZ, XA-XZ, and ZZ as user-defined codes. These will never be used as TLD in the public Internet!

 

So it is feasible to use e.g. 'company.xa' as AD name space. This additionally saves you the cost for having to register a SLD.

 

But since it's not globally unique, you could be example.xa and so could another similarly named company. If this happens, you can never have a trust between the two, or have any interaction between the two internal DNS infrastructures.

 

It's probably got a low probability of happening, but I'd still recommend the guaranteed-to-be-unique ad.example.com.

 

List of New gTLD's http://newgtlds.icann.org/en/program-status/delegated-strings

Edited January 9, 2015 by Alis_Klar