Multi Academy Trust Infrastructure

[karldenton]

In an ideal world, how would you setup a MAT infrastructure?

 

I was thinking about a server at each outreach school, acting as file server and DC. Email is office 365 anyway.

 

Was thinking of a domain at each site, all in a forest and replicated so it can be managed centrally.

 

Thanks

[Marshall_IT]

If you have multiple Secondary schools then you can have a more complex infrastructure.

 

If you've got one Secondary and a few Primaries then pretty much as you've described.

 

I'd add in to it backup locations though and depending on location, site to site links instead of small internet connections for the Primaries.

 

Having the ability to have online off-site backups at another school is a massive cost saver.

[karldenton]

It'll be the main primary site and then adding a couple of other primaries for now.

 

The main site has 150MB virgin broadband load balanced. The other primaries will be 70mb fibre if that would be ok?

[GeekyPete]

I would say so. But it depends on the amount of data. Can you backup your data in the given time window?

 

Will each of the site have their own admin? If so I'd set up one forest (mat.org) with a central forest root server. Each school would have a child domain (School.mat.org) with as many servers as required. Delegate admin of each child domain to the on-site tech. You access AD on the parent domain and can admin the whole forest from there.

 

The only issue comes if the school moves away from the MAT. The orphaned child domain would lose 2 FSMO roles (Domain Naming master Schema Master). The child domain could function indefinitely providing they didn't want to make any major changes, like adding exchange server that would extend the schema. Gaining full control would mean setting up a new domain and migrating over it. But as it wouldn't be your headache at that point it is only of minor concern.

[karldenton]

Many thanks for your input Pete.

 

The local files for each school will be on the server there so it will only be the AD replications mainly that will go from site to site.

 

It will be 2 technicians covering a few sites.

 

I don't suppose I can rename the forest we currently have with 1 domain in? Never done forests and child domains before

[IanT]

Hello,

 

I work for a Multi Academy Trust in the Central IT Team (3rd Line), we run pretty much everything centrally:

 

i'll just bash what its in my head atm..........

 

1. We have 100Mb link from each academy via LGfL going via are own VRF which is connected into 2 of are datacenters, we are starting to rollout ADSL (20mb/s) failover links to some academies.

2. Locally at the academies we have just 1 server which acts at the Hyper-V Server which hosts a domain controller, application server and file server (in some places).

3. We backup all servers centrally using Microsoft DPM 2012 R2 (with almost 800Tb B2D) with backend storage, we have tape libraries using MSL2024 tape libraries ranging from LTO4 to 6.

4. We host exchange (2010) centrally using a DAG, this hosts about 30,000 accounts.

5. We also have a SharePoint Farm (2013), we have growing in the SharePoint area and pushing all academies to use this for file storage at present.

6. We are running about 200 Servers in the center, most of them are hosted on are Cisco UCS which are then connected to NetApp Storage and whiptale which is are SSD array for VDIs.

7. Phone System, centralized are phone system, cant remember the make\model of the system but all acadmies now connect centrally to are phone system reducing costs for each academy.

8. Proxy Server, all sites go via are new proxy servers which we purchased last year Barracuda 910 boxes replacing are old TMG array we were running.

9. We are a single domain which is currently running Server 2008 R2 Domain Controllers, and all local academies have domain controllers also running 2008 R2.

10. We moved away from having wireless LAN controllers at each site to having central wireless, Cisco Flex something (cant remember off the top of my head the model!).

11. All sites currently are running Windows 7 Professional with some Windows 8.1 out there.

12. We are quite hot on are MS System Center products, we are running Config Manager, DPM, Operations Manager, Orchestrator and Service Manager (Central helpdesk) - all are 2012 R2.

[FN-GM]

Hi,

 

We are a growing trust as well, our model is that all Academies share 1 domain. Primary schools are linked via a 100mb point to point back to the central server farm located at a secondary. Secondary will have a 1GB link. The internet connection, filtering and firewalls is located at the central farm, all schools use these.

 

A primary school has a single server with these virtual servers:

 

1 x DC

1 X SCCM Distribution Point

1 X File Server with DFS replication to the central servers.

 

Secondary another matter. It really does depend on the school.

 

We have staff roaming between sites and it works a treat. Thats people with mobile devices as well as using desktops at each site

 

We share other services as well. Such as Wireless with controllers in the central server room. Digital Signage, Sage, IP phone, email system etc

 

Technical support is 1 team supporting all schools. Secondary have someone on site all the time.

[MattGibson]

I have also been asked to cost a central IT Services run from the Academy Trust.

 

Does anyone know what kind of setup costs are involved with the suggestions below? - obviously I understand it depends on how many schools are involved.

 

I'm thinking single forest with school.mat.org would be the ideal route for us.

[SchoolsBroadband]

Hi folks,

 

we've got quite a few MAT's doing what many of you have already suggested.

 

If you can use local point to point links for primary schools then we find most MATs host most of their services, AD and filestore in one of the secondary schools and have this as a big huge. Sometimes they also replicate to another secondary school.

 

If you have sites that could be all over the country and not local then those larger MATs host servers in our data centre instead. This gives the servers up to 10Gbit core connectivity which doesn't saturate a single link to one secondary school.

 

We're also about to launch an IaaS (similar to MS Azure) product so you can simply "spin up" additional server, CPU and disk resources on any VLAN you require over your WAN at the click of a few buttons. This enables you to also do end to end QOS across your entire WAN and give flexibility when adding more resources. All sites can come with additional DSL, FTTC or EoFTTC backup or a leased line via an alternate carrier.

 

I can put you in touch with some of our customers if you'd like and you can chat with them about how they do it?

 

Thanks

 

Dave

[Asgard]

The only issue comes if the school moves away from the MAT. The orphaned child domain would lose 2 FSMO roles (Domain Naming master Schema Master). The child domain could function indefinitely providing they didn't want to make any major changes, like adding exchange server that would extend the schema. Gaining full control would mean setting up a new domain and migrating over it. But as it wouldn't be your headache at that point it is only of minor concern.

 

I have just had to do the 'minor concern' bit. We became the sole sponsor of a school (instead of a co-sponsor) and it was a child domain in the previous trusts AD.

 

Pretty much wiped the entire thing and built them their own domain, to speed up the entire process.

 

Now to look at some long term plans and there are already some great pointers on here.

[localzuk]

The way "moving away" was handled in Bristol when Northgate stopped providing IT for schools was to make clones of the DCs and put them in each school, then delete the other parts of the AD structure.

 

Meant each school ended up with 4 DCs, but it worked.

[karldenton]

We have offsite nurseries already and I was thinking of going down the Sophos UTM way with a RED15 at each site, linking it back to the servers at the main site. Has scope for additional primary schools if needed.