New domain best practice advice

[woreilly]

This Summer, I will be installing a new server at a large middle school which is currently transitioning into a secondary school. Can anyone offer me some advice on what I should be including in the setup?

 

I will have two host servers to play with. Both will run Server 2012R2 with Hyper-V VMs. My initial thoughts as to how to divide the roles needed are as follows:

 

[TABLE=class: outer_border, width: 500, align: center]

[TR]

[TD]Host 01[/TD]

[TD]vDC 01: AD, DHCP, DNS, DFS etc[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]vUTL 01: WDS/MDT, WSUS[/TD]

[/TR]

[TR]

[TD]Host 02[/TD]

[TD]vDC 02: Secondary Domain controller

[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]vUTL 02: Sophos, Printers[/TD]

[/TR]

[/TABLE]

 

Host 01 will be the new server with 64GB RAM. Host 02 will be the current server, rebuilt from 2008R2 to 2012R2 and 24GB RAM.

 

My initial thoughts are that I should be configuring DHCP failover. Are there any other redundancy features I should be building into the system? Or even any additional features that, whilst not necessarily offering redundancy, offer extra functionality to the domain?

 

I also have two NAS devices to hold some form of backup. I was thinking of using the free version of Veeam to backup VMs (subject to storage space) to one NAS and then use the existing Macrium Reflect software they have to backup data to the other.

[Davit2005]

Defo have DNS on both DC's and think about DHCP resilency, 2012 R2 offers a few more options as far as DHCP resilency as well as split scopes.

 

I can't see anything wrong with using the free version of Veeam with Hyper-V, unfortunately you will get limited support if any so using this method in a production environment may not be ideal. You will also have to schedule backups with PowerShell via Task Scheduler because I don't think you can schedule in the free version.

[Oaktech]

Your secondary DC should have DNS on it too, and DHCP failover.

 

Do you have Impero or similar? You might want to create a server for that. Have you considering remote working? if so you might want to bring up another server for RDS or DirectAccess or VPN.

 

I assume the servers have DAS and therefore you can't create a Cluster? If you've got enough storage on the new server you might want to investigate allowing replication of the VMs on the older server to the new server to provide a bit more insurance against the old server failing.

 

I'm using built in windows server backups and, at the moment, rsync to replicate backups. I decided Veeam was a complication I didn't need.

[zag]

I personally would not have the DC's as hyper-v hosts as well.

 

I always prefer to have a dedicated Domain controller and one virtualized one. Then the hosts on separate machines.

[Oaktech]

I personally would not have the DC's as hyper-v hosts as well.

 

I always prefer to have a dedicated Domain controller and one virtualized one. Then the hosts on separate machines.

 

I'm not quite sure what you're getting at here...

 

I believe best practice no-longer requires a physical DC, although I prefer to have one too. I believe the OP is suggesting he has 2 hosts with DCs running as VMs on top of them, leaving the hosts as dedicated which isn't too much of a problem I wouldn't have thought?

 

OP: If you are short of hardware a DC can be run on a moderately specced PC, although an HP Microserver is absolutely ideal!

[dblight]

I would cluster both hosts!

[woreilly]

I personally would not have the DC's as hyper-v hosts as well.

 

I always prefer to have a dedicated Domain controller and one virtualized one. Then the hosts on separate machines.

 

All 'servers' will be virtualised, both DCs will be Hyper-V VMs running on separate physical hosts.

[woreilly]

Your secondary DC should have DNS on it too, and DHCP failover.

 

Do you have Impero or similar? You might want to create a server for that. Have you considering remote working? if so you might want to bring up another server for RDS or DirectAccess or VPN.

 

I assume the servers have DAS and therefore you can't create a Cluster? If you've got enough storage on the new server you might want to investigate allowing replication of the VMs on the older server to the new server to provide a bit more insurance against the old server failing.

 

I'm using built in windows server backups and, at the moment, rsync to replicate backups. I decided Veeam was a complication I didn't need.

 

Host-01 will be a Dell PowerEdge T430 with 8 x 1TB HDDs (2 x 1TB in Raid 1 for OS, 5 x 1TB in Raid 5 for Data, 1 global hot spare)

Host-02 is a Dell PowerEdge T610 and has 8 x 500GB HDD (if memory serves me right, it is 2 x 500GB in Raid 1 for OS and 6 x 500GB in Raid 6 - I inherited the server 3 years ago when I took over from previous tech)

Edited July 18, 2016 by woreilly
Extra info

[Blue_Cookeh]

The notion of a physical domain controller is out the window nowadays, just ensure you sync one of the the two VMs to an external NTP source and turn off time synchronization for that VM in Hyper-V.

 

Looks good to me, if you have enough storage on both hosts I'd configure replication as a secondary measure if one of them fails. Also 1TB seems like a waste of storage space just for the OS, I'd probably stick an SSD or two in there if possible and give that extra 1TB back to the VMs. I usually only allocate 60GB to host storage.

Edited July 18, 2016 by Blue_Cookeh

[woreilly]

Defo have DNS on both DC's and think about DHCP resilency, 2012 R2 offers a few more options as far as DHCP resilency as well as split scopes.

 

I can't see anything wrong with using the free version of Veeam with Hyper-V, unfortunately you will get limited support if any so using this method in a production environment may not be ideal. You will also have to schedule backups with PowerShell via Task Scheduler because I don't think you can schedule in the free version.

 

I should have expanded on Host-02. At the very least it was going to have DNS on it as in my experience you don't actually have any choice when it comes to promoting to a DC. I was also thinking of doing DFS replication between the two servers as well as implementing a DFS Namespace.

[woreilly]

I would cluster both hosts!

 

Would the cluster need to be setup during the initial server build or can it be done later on down the line?

[Guest obsidianpillar]

I believe a cluster has to be setup before any of the VM's are configured.

The first question is which version of Server 2012 R2 are you running? Even if it's Standard I'd recommend having a separate Virtual Server to host DFS/File and Storage Services and to use a Virtual Disk for storage, stored on the physical drive rather than putting the drive Offline in Disk Management and assigning it to the VM.

In practice working with other business', this approach has worked well for us and if I ever have to do restorations it makes the process a lot easier when it comes to expanding storage.

I'm certainly not one for an "all eggs in one basket approach" whereby all roles are installed on one Server, regardless of how they are backed up.

I'd also recommend creating several namespaces e.g. for Staff and Students. I'd look to setup Disk Quotas for Students and Staff, especially as your describing it as a "large middle school". I'm sure we all know the classic cases of Students (and equally Staff!) downloading illegal MP3's and videos and storing it in the Downloads folder etc.

Also, I second the recommendation of having DHCP failover between the two DCs, again I do this in my environments and have had no problems, if you have several hundred clients, perhaps look at load balancing, depending on the amount of RAM vCPU's etc assigned to "vDC-01".

Are you planning to implement BYOD/1:1 schemes further down the line? If your looking at anything such as DirectAccess for remote working for Staff, it can't be installed on a DC so you'd need a separate VM again to host that. I'd also look to setup RADIUS for the wireless clients.

I'd look to have Sophos on it's own Server (again, licence permitting) as it's hosting SQL which obviously is a huge memory hog. Dont use dynamic memory on anything reliant on SQL e.g. SIMS as it tends to slow down all the other VM's. That being said, I deploy out a "MGMT-01" VM which manages smaller applications such as UniFi which aren't as heavily used and processor intensive.

Look at SAAS monitoring for the clients, Cisco Meraki Systems Manager is what I choose to deploy. But other software providers such as AutoTask/lmpero prove to be popular these days with schools depending on what you can afford.

As it's a school environment, security needs to be tight, strict auditing on shares, user access as well as web monitor logging are a must. I did a post a while back on Controlled Assessment best practices if your interested in looking back at it Certainly gives a few pointers which can be recycled into different uses. Even the stuff that you think Kids wont get onto, it only takes one to find a flaw and then half the school are on it. Do the usual things such as removing the shortcut option from the shell, restricting network drive maps etc and half the battle's won already.

Also, there's the obvious ones such as protecting passwords (eg MDT, as you referenced it in your original post). Don't run deployments/scheduled tasks as Domain Admins, create separate accounts for them with permissions only relevant to their role. Keep Scripts out of the obvious NETLOGON share as it's anyone with the slightest bit of server knowedge's first port of call when it comes to trying to find scripts with the possibility of passwords contained within them. I created a share in a new namespace called "Group-Policy" where all scripts are placed in all my environments.

Personally In regards to general function of the Domain, support is important. Are you working at the school full time or are you contracted through a separate business? If your only in part-time, look at something like Spiceworks and setup a helpdesk to handle support requests. The general rule of "KISS" is important, keep your OU's tidy, Group Policy kept in order and clearing up DNS once in a while keeps management in the long term easier. You want to do the hard work now, but enjoy less problems in the long term!

Also, I notice your located in Worcestershire. I'm based in Kidderminster however am on holiday until the start of August. If you wish to get in contact with me where I'd be happy to go into further detail on any of the topics, feel free to send me a PM.

Regards,

Tom

Edited July 18, 2016 by obsidianpillar

[woreilly]

Thanks Tom (and everyone else) for your response. Let me address each question/point you pose.

 

I believe a cluster has to be setup before any of the VM's are configured.

The only issue I see with setting up clusters is that the new host server (and vDC-01) will be built in our office and the current existing host will be rebuilt onsite so I'm not entirely sure setting up a cluster will actually be feasible.

 

The first question is which version of Server 2012 R2 are you running? Even if it's Standard I'd recommend having a separate Virtual Server to host DFS/File and Storage Services and to use a Virtual Disk for storage, stored on the physical drive rather than putting the drive Offline in Disk Management and assigning it to the VM.

In practice working with other business', this approach has worked well for us and if I ever have to do restorations it makes the process a lot easier when it comes to expanding storage.

It will be 2012R2 Standard. It is my understanding that with the Standard licence, you are only permitted 2 virtual machines per physical host. If I were to implement a separate file server, I would have to combine it with the "vUTL" VM I intend to create. Our standard setup is using VHDX files stored on the physical hosts as opposed to mounting a whole physical drive to the VM.

I'm certainly not one for an "all eggs in one basket approach" whereby all roles are installed on one Server, regardless of how they are backed up.

When I started at the company 3 years ago, they were in the habit of doing the "all eggs in one basket approach". Not long afterwards, virtualization became a standard once we knew as much as we needed to know to provide a sufficient system for a school. When 2012 was around and you could use 4 VMs, we did vDC, vFS and vUTL approach. Due to the limitation of 2 VMs per physical with 2012R2 we generally do vDC and vUTL with files/data hosted on the vDC.

 

I'd also recommend creating several namespaces e.g. for Staff and Students. I'd look to setup Disk Quotas for Students and Staff, especially as your describing it as a "large middle school". I'm sure we all know the classic cases of Students (and equally Staff!) downloading illegal MP3's and videos and storing it in the Downloads folder etc.

 

I have already discussed with the school about storage quotas. My suggestion was 50GB for SMT, 20GB for Admin Staff & Teachers, 15GB for TAs, 10GB for the oldest two years of pupils, 5GB for the youngest years of pupils.

 

They also suggested having a separate shared drive for 'media' and that we do a regular search for all well known media types, especially video, on the non-media shared drives and move them onto this media drive. We may then also limit that to 250GB max.

 

Currently, a full backup of the current server's data, critical and non-critical, is around 820GB. There will be around 2.0-2.5TB of storage available on the new server.

Also, I second the recommendation of having DHCP failover between the two DCs, again I do this in my environments and have had no problems, if you have several hundred clients, perhaps look at load balancing, depending on the amount of RAM vCPU's etc assigned to "vDC-01".

 

I think at this stage, having seen everyone's responses, DHCP failover will definitely happen! Off the top of my head, they have around 100-120 clients in the school.

Are you planning to implement BYOD/1:1 schemes further down the line? If your looking at anything such as DirectAccess for remote working for Staff, it can't be installed on a DC so you'd need a separate VM again to host that. I'd also look to setup RADIUS for the wireless clients.

 

As they have signed up to OVS-ES we will be deploying Windows 7 Enterprise (don't ask about Windows 10, it's a sore subject ) which will make DirectAccess a possibility later on down the line. However, teachers generally don't have laptops that are any good and there are no plans to replace them any time soon as all the main teachers machines in each classroom were replaced with HP desktops not too long ago.

 

The school currently have Aruba 105 APs which are performing to an acceptable standard so there are no plans to upgrade or buy RADIUS any time in the next couple of years.

I'd look to have Sophos on it's own Server (again, licence permitting) as it's hosting SQL which obviously is a huge memory hog. Dont use dynamic memory on anything reliant on SQL e.g. SIMS as it tends to slow down all the other VM's. That being said, I deploy out a "MGMT-01" VM which manages smaller applications such as UniFi which aren't as heavily used and processor intensive.

 

Sophos will be on a VM along with the printers. They have 5 networked printers which are currently run on an ageing PowerEdge 1900 server running 2008R2 with only 4GB RAM hence why I have no issues with putting them on same server as Sophos. The host it will be going on with the 2nd vDC has 24GB RAM. I was thinking of splitting it up with 12GB RAM for vDC-02, 6GB for Sophos/Printers & the remainder for the host itself.

 

I only ever use fixed memory on my VMs. Never looked into the benefits of dynamic memory much. Having said that, I am open to looking into it in the future.

Look at SAAS monitoring for the clients, Cisco Meraki Systems Manager is what I choose to deploy. But other software providers such as AutoTask/lmpero prove to be popular these days with schools depending on what you can afford.

 

They have previously been looking at "LanSchool" as a monitoring/control software. Impero may be an option depending on what kind of deal we can get for them.

As it's a school environment, security needs to be tight, strict auditing on shares, user access as well as web monitor logging are a must. I did a post a while back on Controlled Assessment best practices if your interested in looking back at it Certainly gives a few pointers which can be recycled into different uses. Even the stuff that you think Kids wont get onto, it only takes one to find a flaw and then half the school are on it. Do the usual things such as removing the shortcut option from the shell, restricting network drive maps etc and half the battle's won already.

Also, there's the obvious ones such as protecting passwords (eg MDT, as you referenced it in your original post). Don't run deployments/scheduled tasks as Domain Admins, create separate accounts for them with permissions only relevant to their role. Keep Scripts out of the obvious NETLOGON share as it's anyone with the slightest bit of server knowedge's first port of call when it comes to trying to find scripts with the possibility of passwords contained within them. I created a share in a new namespace called "Group-Policy" where all scripts are placed in all my environments.

Generally our standard NTFS & Share permissions hold up. It has been highlighted previously that MDT could be locked down. As well as a learning curve for myself, I was going to use it as an opportunity to identify & highlight areas where we could improve the security of networks and domains that we implement. To my knowledge, we have had no serious breaches in my time but who's to say we won't ever come across a child genius who spots things we don't?

Personally In regards to general function of the Domain, support is important. Are you working at the school full time or are you contracted through a separate business? If your only in part-time, look at something like Spiceworks and setup a helpdesk to handle support requests. The general rule of "KISS" is important, keep your OU's tidy, Group Policy kept in order and clearing up DNS once in a while keeps management in the long term easier. You want to do the hard work now, but enjoy less problems in the long term!

 

As you might have guessed from some of the above points, I am contracted to the school through a separate business. They do have a full time ICT Tech who I have essentially trained and will be able to train him sufficiently on their new domain that he will be able to effectively support it. Generally the staff phone him and he is quick to sort out their issues. Before he came along they did use our "Online Logbook" facility so that could still be used if issues ever became so frequent.

Also, I notice your located in Worcestershire. I'm based in Kidderminster however am on holiday until the start of August. If you wish to get in contact with me where I'd be happy to go into further detail on any of the topics, feel free to send me a PM.

Thank you for all the advice and tips you have given! If you don't mind my asking, who do you work for? You can PM me if you'd rather not say publically!

[Guest obsidianpillar]

Hi, I'm currently freelance. I do work for a limited number of selected clients.

[PotNoodleTech]

You can't set up a hyper-v cluster using the local storage on each server, you would need to have some kind of shared storage, be it NAS/SAN/DAS. Be wary of setting up a cluster using low grade NAS box with low grade SATA drives - with two servers sharing the strage performance will be poor.

 

You could run all the VMs on server 1, and then set up replication to replicate the VMs on to sever two. That way all your VMs always run on the newer more reliable, faster server, and if that server ever has a problem the older server will take over for the duration of the "issue".

[Tefters]

Can't emphasise enough the cluster + shared storage route. Your transitioning to a secondary school and will need the resilience, of course you should then have resilience on your shares storage and management network too but it's up to you how far you go.

 

Cheapest and quickest solution, go 4 servers, 2 clusters of 2, 1 for storage and 1 for VM's, the VM hosts will need a load of ram while the storage hosts will need disk space.

Use deduplication on the storage hosts and away you go, also these will ideally be running 10k+ sas disks.

 

Alternatively your looking at 2 San shelves with controllers for mirroring along with disks.

 

I manage a secondary school here with 1400 students and 250 staff.

I run quite a large and proud hardware setup along with the ability to spin up VM's for anything, currently running 22 with all sorts of roles from Remote Access Gateway and Desktop to DC's, Skype4Business, ADFS etc...

 

Do not skimp early in your design or it will hurt you in the long run! I've consulted secondary schools running NAS's and well the stem of all there problems was disk IOPS and NAS performance.

 

Ideal SAN recommendation - NetApp but 2 low spec DL380's full of 10k's in a cluster with deduplication is just as good.

 

My 2 cents.

 

P.S. If they are transitioning to a secondary school what's the numbers for target audience staff and student?

 

2 hosts with no shared storage is very rogue for my liking going into a secondary school.

Edited July 20, 2016 by Tefters

[Guest obsidianpillar]

Hi @woreilly

 

How did this go? Coming up to a year now since the thread was posted so would be interested as to how the build went.

 

Cheers.