sted Posted July 17, 2015 Posted July 17, 2015 In one of my schools its been decided that as they are getting a load of new equipment and going to a single network and were going to start a new domain from scratch. I think its probably not a bad idea to buy a domain schoolname.eu (or something else currently not in use by the school) and use that for the domain name rather than school.local. Any gotchas or anything i need to do to make this work(or any good resources). Im suspecting that things like workfolders/direct access may become more relevant in the coming years and i suspect having matching internal and external domains may make this sort of stuff easier in the future.
3s-gtech Posted July 17, 2015 Posted July 17, 2015 Reserving a name so that someone else doesn't register it and cause DNS havoc isn't a bad idea. Giving your domain a publicly available DNS name isn't necessarily going to be useful though - it depends on what services you need in and out of school, availability of reverse proxies for giving your services external IPs etc. Certainly never use .local - why would you? You'll just be creating issues for yourself. We just use a made up domain convention that can't be registered easily (schoolname.sch.uk). So, it depends what you want to achieve. 1
Blue_Cookeh Posted July 17, 2015 Posted July 17, 2015 (edited) Microsoft best practices tell you to use a subdomain of your public domain, like ad.school.cty.sch.uk. See http://social.technet.microsoft.com/wiki/contents/articles/17974.active-directory-domain-naming-considerations.aspx Edited July 17, 2015 by Blue_Cookeh 2
sted Posted July 17, 2015 Author Posted July 17, 2015 Reserving a name so that someone else doesn't register it and cause DNS havoc isn't a bad idea. Giving your domain a publicly available DNS name isn't necessarily going to be useful though - it depends on what services you need in and out of school, availability of reverse proxies for giving your services external IPs etc. Certainly never use .local - why would you? You'll just be creating issues for yourself. We just use a made up domain convention that can't be registered easily (schoolname.sch.uk). So, it depends what you want to achieve. new domains i havnt been using .local for a while ive been using .internal. Im trying to save myself problems long run so as services become more and more accessible from wherever on whatever as im starting from a blank slate i thought now would be a good time to revisit the assumption ive always been lumped with of never use a real world address for ad it will cause you issues. Ive been trialing workfolders on vms and while it can work if your domain name and external dont match its a bit of a cludge having schoolname.eu would mean if its available outside on the same name i was thinking it might if nothing else make life simpler for users (i might even when i create users use their office 365 logins (well the first bit currently they are entirely unrelated and no dirsync ive kept them separate again something i may revisit one day)) 1
featured_spectre Posted July 17, 2015 Posted July 17, 2015 @Blue_Cookeh all best practices suggest that. We're moving ours over (PITA), but eh, needs to be done to remove it from a .local 1
ITGURU Posted July 17, 2015 Posted July 17, 2015 Have run .local domains here for 13 years, includes a migration of 2 separate forests (.locals) into a brand new domain due to a merge. Never caused any issues whatsoever!
3s-gtech Posted July 17, 2015 Posted July 17, 2015 Do you use Macs, iPads, Apple TVs etc in any of those schools?
ITGURU Posted July 17, 2015 Posted July 17, 2015 We have a few iPads and Macs but don't utilise a mac Server - the iMACs are added to AD and login with their normal credentials to access home directory and internet.
featured_spectre Posted July 17, 2015 Posted July 17, 2015 Have run .local domains here for 13 years, includes a migration of 2 separate forests (.locals) into a brand new domain due to a merge. Never caused any issues whatsoever! Do you run anything Apple related? whilst it took a while to get working with .local here, it was a massive faff! Also I believe certificates for exchange will expire if they run on a .local domain beyond October (I could be wrong but it was mentioned in my IT office not long ago).
ITGURU Posted July 17, 2015 Posted July 17, 2015 Do you run anything Apple related? whilst it took a while to get working with .local here, it was a massive faff! Also I believe certificates for exchange will expire if they run on a .local domain beyond October (I could be wrong but it was mentioned in my IT office not long ago). All services that use SSL certificates including exchange are all set to use our internet domain name, .local is not included/needed in the certificate.
Norphy Posted July 17, 2015 Posted July 17, 2015 Anything Apple (or anything else which uses zeroconf DNS) will probably be problematic on .local domains as Bonjour uses .local as its DNS zone. Having a .local domain interferes with that.
sted Posted July 17, 2015 Author Posted July 17, 2015 Do you use Macs, iPads, Apple TVs etc in any of those schools? me? yes 1, some,no
sted Posted August 7, 2015 Author Posted August 7, 2015 right so lets assume im using sub domain of a real domain I own so ad.school.uk. If I want to get workfolders/direct access working I assume I just need to go to my external dns control panel with the hosts and redirect workfolders.ad.school.uk to 1 external facing ip address (and obviously open appropriate ports) ditto for direct access. I also need certificates either self signed or bought. what type of real certificate would I need and roughly how much is it going to set me back. Im thinking that work folders is a good idea for ipads as theres a client so staff can have a share they can sync with those and direct access means they can access network documents without ts licensing and it just works at home like it does at work
featured_spectre Posted August 7, 2015 Posted August 7, 2015 You can buy some certs which will allow upto 25 subdomains for around £100. This would suit your needs. We got ours from godaddy in March. 1
detjo Posted August 18, 2015 Posted August 18, 2015 Also I believe certificates for exchange will expire if they run on a .local domain beyond October (I could be wrong but it was mentioned in my IT office not long ago). ... and, applications for new https SSL certificates will be declined and all existing ones will be revoked by Oct 2016 for .local 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now