Domain from scratch questions

[TomHD]

Hello All,

 

I have managed a few domain/networks but never installed one from scratch. I am now going through the motions of doing so and would like some ideas I am doing this in a test environment which is entirely independent of my working domain/network.

 

I have:

 

Installed Win Server 2012R2 on some hardware.

Installed AD DS.

Installed DNS.

Installed DHCP.

 

What would be my next logical steps? Create some user groups, users and group policies? Where do I start regarding image creation? SCCM? Anythings I may have missed? Any help and pointers will be appreciated

 

Many thanks, TomHD

[SHimmer45]

if your going to use SCCM i would install it now to see if you want to use it, other options for deployment which can be added would be MDT.

WDS is very useful for network booting with MDT

 

id then replicate your existing user structure policies and environment (GPO)

[lmrogers]

How have you setup your test enviroment to be completely independant of your work domain/network?

[TomHD]

@SHimmer45, thanks I wil look at those regarding replication, we run a RM CC4 network and with this test domain I want to stay away from anything like that and I also think I may learn more by configuring users/computers/policies from scratch?

 

@lmrogers, my test server is not connected to the work network. I am using an old Netgear wireless ADSL router to create the test network, only real problem with this is no Internet connection, is that an issue you think?

Edited May 17, 2016 by TomHD

[psydii]

I have hope that at some point soon Microsoft might produce a detailed 'reference architecture' that directly answers your question.

 

But meanwhile, if you are building out from scratch, as well as your on-premises infrastructure you should have a DC in Azure (in a separate 'AD Site') and put Azure AD Connect up there with it to provision your Office365 accounts.

https://azure.microsoft.com/en-gb/documentation/articles/active-directory-install-replica-active-directory-domain-controller/

https://azure.microsoft.com/en-gb/documentation/articles/backup-azure-vms/

https://azure.microsoft.com/en-gb/documentation/articles/active-directory-aadconnect/

 

Then hook the whole thing up to Google.

https://azure.microsoft.com/en-gb/documentation/articles/active-directory-saas-google-apps-tutorial/

 

Finally, look to InTune for managing apps and devices.

[Duke5A]

If budget allows don't put all your eggs in one basket.

 

• Primary Domain Controller
  - Can hold all FSMO roles
  - DNS
  - DHCP (split scope setup with secondary DC)
  - Radius (if needed)
  
• Secondary Domain Controller
  - Mirror of the primary
  - DHCP (split scope setup with primary DC)
  
• Utility Server
  - WDS/MDT/SCCM
  - WSUS
  
• File Storage
  
• Certificate Authority (if needed, most don't)
  - Never place your CA on a domain controller
  
• Print Server
  

 

I've had problems with one service or another during operating hours and it helps to keep distinct roles on separate installs. Taking one thing down for service in the middle of the day that way doesn't stop your users from being able to work.

[jdoldridge]

@TomHD We are currently doing the same thing. I have built a DC hosting DHCP and DNS, an SCCM server and a file server all on VMware on one host so I could utilise the local network and create a completely separate network to the RM one which is currently running in production. We are looking at creating a new VLAN soon for the new network so we can begin build testing on some of our existing hardware which we have on site but still keep it separate. I would advise getting stuck into SCCM as soon as possible because it can be quite a learning curve if you have not used it before but it well worth the time and effort in the long run. A good site for getting yourself acquainted with SCCM is prajwaldesai.com or windows-noob.com

 

Feel free to PM me at any point seems as we are both doing the same kind of project!

[Oaktech]

[*]Secondary Domain Controller

- Mirror of the primary

- DHCP (split scope setup with primary DC)

 

If we're using 2012r2 we can set up DHCP failover without the hassle of split scope.

 

https://technet.microsoft.com/en-us/library/hh831385(v=ws.11).aspx

Edited May 17, 2016 by Oaktech

[TomHD]

Thanks for all the above responses I'll have a good look through them all later on.

 

For now in my testing environment, can I install SCCM on my DC? Or would I benefit from putting it on another server?

 

And if I am to make other servers, should I configure a virtual host and make any additional servers virtual? I should probably do this as it will be useful when imaging computers too, this correct?

 

Thanks again

[Oaktech]

Thanks for all the above responses I'll have a good look through them all later on.

 

For now in my testing environment, can I install SCCM on my DC? Or would I benefit from putting it on another server?

 

And if I am to make other servers, should I configure a virtual host and make any additional servers virtual? I should probably do this as it will be useful when imaging computers too, this correct?

 

Thanks again

 

As the SCCM server will host updates, and the updates take up a lot of space I would put it on another server. I coexist my Impero install with SCCM perfectly happily but if you have the opportunity to have an individual server for everything then do it!

[lmrogers]

@TomHD the only issue with not having an internet connection i found was not being able to activate the servers and getting the pre reqs for certain things and for testing windows updates before applying them to the live network its hard without an internet connection.

[jdoldridge]

I would certainly setup a virtual host if possible. It makes things much easier when you are building a testing images if nothing else but it will be much better if you can separate your services onto different servers.

[TomHD]

Thanks for the response so far

 

As this is a test scenario I'm not too concerned about installing SCCM on my test DC, please tell me if this is a big no no or just out of preference of not putting all eggs into one basket!?

 

I am working through the prerequisites for SCCM and am at the Windows Assessment and Deployment Kit stage. I am wanting to test Windows 10 installations and have no interest in Windows 7/8/8.1. The guide I'm following states installing ADK for 8.1 but I assume I will go straight to ADK for 10?

 

I'm going to configure a virtual host to simplify the testing of images so thanks for that advice.

 

How can I connect my test DC to the Internet without causing any issues with my working network? I'm guessing that as my test DC is a DHCP server too I'd be opening a can of worms if I just go direct to the working network?

 

Many thanks, TomHD

Edited May 18, 2016 by TomHD

[SHimmer45]

easiest way would be to have a firewall and proxy like smoothwall express / pfsense box connected to your "test network"

for example on my test machine (hyper-V) here i have a couple of DC's and test deployments which are connected to an internal only network and a smoothwall proxy which has a connection to this internal network and one connection to the main lan. All internal traffic stays within the internal only network inc DHCP requests etc.

 

if you have a physical test network running off a single a switch grab a pc with two network cards

install smoothwall

setup one interface with an IP on your current "production network"

setup one interface with an IP on your "Development Network"

 

--Production network--

|

|

Interface with production network IP

Smoothwall

Interface with Guest network IP

|

|

Switch

|

--Development Network--

 

excuse hideous diagram

[TomHD]

Will have a look at the shortly, thanks @SHimmer45.

[Pashers]

Hey TomHD,

 

I'd agree with Duke5a server wise.

Also SHimmer's idea of the firewall should do the trick

 

After installing the servers/roles (AD, DHCP, DNS, WSUS/SCCM, File server, print server, etc)

I'd look into how you would want AD to be structured (I tend to think simpler the better, not too many OUs etc).

The settings you wish to provide through group policy (this will take time, and alterations).

Then look into how to use SCCM.

 

SCCM on a completely different server (not DC). As this is a realatively big package (and very powerful). WindowsNoob has some really good stuff on SCCM (https://www.windows-noob.com/forums/topic/4045-step-by-step-guides-system-center-2012-r2-configuration-manager/). It's how I got started on it. Just don't install CAS (like I did) you'll end up puzzled.

 

 

Exciting times