2 Organisations, 1 network?

[techie08]

Hi Everyone

 

Bit more of a random one, I manage the IT for a secondary school, and the management of this school also run a charity that's has 2 separate sites providing education for disabled special needs children ( aged 16 +)

 

The Charity at both sites also house some students and staff from the Secondary school most days of the week.

 

Despite the school and charity being separate entities ( but under a he same umbrella) am I allowed for both sites to use and he same Active Directory and server and infrastructure?? Can the secondary school buy laptops and iPads etc for the charity? As the charity has to pay VAT I'm not sure if the secondary school is allowed to buy equipment for use on the charity sites?

 

Hope that sort of makes sense

Edited September 18, 2016 by techie08

[HPlum78]

The VAT issue I am unsure of but my wife who is an accountant pointed me at this [h=2]When you must register for VAT[/h]You must register for VAT if your charity’s VAT taxable turnover (the total value of everything you sell that isn’t exempt from VAT) is more than £83,000.

You can choose to register if it’s below this, eg if you want to reclaim VAT on your supplies.

 

from here https://www.gov.uk/vat-charities/overview

 

Buying supplies via your school and donating them is allowed but would have to think about how that would look... that's all I have been told (she don't work for free! :-P)

 

As for the one domain, yeah sort of makes sense to align them, as you will realise all the benefits of doing so. Without more detail of the setup of i.e. what the namespaces look like its hard to give a more descript answer.

[3s-gtech]

Personally, I would have two ADs. There could be a two-way trust between them, but keep the distinction. The same goes for VLANs, DHCP scopes etc. You can link everything very nicely at the router if you need to, but I just foresee issues with amalgamating the two intrinsically.

 

I'm sure the school could buy iPads for the secondary, but it needs to be completely transparent, made as donations, and bear in mind any negative publicity aspect this may have depending on your financial situation. It needs to be totally clear that this isn't just being done to avoid paying VAT.

[forkies]

Separate entities = separate data protection to start with. Items owned by the school cannot be used by the charity unless under a contract of some sort otherwise could be deemed mis use of funds. You really need to consult legal about that before moving forward.

[Chris1182]

I was presented with the same problem earlier this year. I work for a larger company that wanted to create a smaller sister company.

 

As the sister company was only very small (one site, two PCs and 5 staff) it didn't make sense from a financial point of view to setup another DC, Terminal server, Exchange server etc.

 

To get around this I setup new OUs for the users, computers and security groups within AD. Group policies were copied and linked to the new OUs with changes made that were relevant to the new company such as wallpaper and desktop shortcuts etc. A new folder was created on the file server which acts as the mapped drive for the new company with deny permissions set for everyone else to prevent access. (Users from the primary company were given access via item level targeting). One thing to note is that default scope will always be authenticated users so a new domain users Security group was setup for the second company for top level group policy and file access permissions.

 

Exchange needed a bit more work but wasn't too difficult. A new address book policy was created for the new company via Powershell and at the same time new online and offline address lists were created containing only the users belonging to company number two. New users were linked to these address lists during setup and also via a custom attribute unique to these users.

 

Whilst the above may not seem like best practice it is essentially the same as creating multiple departments within the same domain that do not interact with each other.