TwistedHelixis Posted October 19, 2018 Posted October 19, 2018 Each of my primary schools are 90% cloud based (G Suite) and when Sims / FMS finally go online we will not need our Data / SQL server anymore, YAY. Our current server setup is 1 host with 2 VM's, one vm is the DC vm and the other is our Data vm with SQL & Sims etc. All clients are Windows 10 with a few Android tablets but no Chromebooks. Looking / planing ahead, next year our Dell server warranty will end and I assume we will need to get a new on site server for DC functions (DNS, DHCP, GPO) So I have 2 questions, Do we still need an onsite all singing Windows server or is there an alternative for DNS, DHCP & GPO? If we do need an onsite Windows server, what hardware options should I be looking at? We will not need massive amounts of space or power so we could possible get something smaller than our current Dell PowerEdge T430, although I would still probably like hardware raid etc. Also, I would still probably setup the server in a host VM config. Any suggestions?
peej2k Posted October 19, 2018 Posted October 19, 2018 DNS and DHCP you could do off a Raspberry Pi if you were to be so bold, or your router. GPO. There isn't an alternative as far as I'm aware, though if you're just waiting on SIMS Primary, why not Chromebook in the future? I'd definitely go VM if you're hosting anything these days. It's just so much more simple to backup/move data etc. 1
3s-gtech Posted October 19, 2018 Posted October 19, 2018 Your AD can move into the cloud, sure (Azure AD) but it is not a cheap step to take. For DNS and DHCP you'll need something your side of the router though - it can be just a simple box or a function of the router/switch. I'd say that these are fairly big steps for the benefits though.
Norphy Posted October 19, 2018 Posted October 19, 2018 Your AD can move into the cloud, sure (Azure AD) but it is not a cheap step to take. For DNS and DHCP you'll need something your side of the router though - it can be just a simple box or a function of the router/switch. I'd say that these are fairly big steps for the benefits though. Azure AD and local AD are not the same thing. Having Azure AD doesn't mean that you can replace your on-site AD and have it do the same thing. You could have a DC up in the cloud on an Azure or AWS VM but I expect performance for that wouldn't be great. 1
bossman Posted October 19, 2018 Posted October 19, 2018 @TwistedHelixis Why don't you go fully Chromebooks for staff and Students?... Are there legacy applications that you use only on Microsoft OS?.... You could build all your laptops and desktops to Chrome OS if they are up to it and just use your Smoothwall for DNS as you wouldn't require DHCP as the Chrome OS would authenticate with the licenses through the GSuite Admin Console.....as long as they are registered with the license... Its the way we are going eventually when we get rid of the legacy applications that require Microsoft OS to function.... Just a thought..... 1
Primus Posted October 19, 2018 Posted October 19, 2018 @TwistedHelixis Why don't you go fully Chromebooks for staff and Students?... Are there legacy applications that you use only on Microsoft OS?.... You could build all your laptops and desktops to Chrome OS if they are up to it and just use your Smoothwall for DNS as you wouldn't require DHCP as the Chrome OS would authenticate with the licenses through the GSuite Admin Console.....as long as they are registered with the license... Its the way we are going eventually when we get rid of the legacy applications that require Microsoft OS to function.... Just a thought..... What? You'd still need DHCP - unless you're setting each Chromebook with a static IP??? 1
bossman Posted October 19, 2018 Posted October 19, 2018 What? You'd still need DHCP - unless you're setting each Chromebook with a static IP??? If you don't want to do this then DHCP can be sorted through your Smoothwall no problems...... 1
3s-gtech Posted October 19, 2018 Posted October 19, 2018 Azure AD and local AD are not the same thing. Having Azure AD doesn't mean that you can replace your on-site AD and have it do the same thing. You could have a DC up in the cloud on an Azure or AWS VM but I expect performance for that wouldn't be great. Sorry, your explanation is better and more what I meant. Yes, I'd expect it to not work that well - would need to be configured with Always on VPN or Direct Access I'd guess.
Norphy Posted October 19, 2018 Posted October 19, 2018 DA and AOVPN aren't really designed for that scenario. I'd expect you'd be using an IPSEC tunnel or something similar if you were going to do that. I mean, it could work if you had a fat enough pipe with low enough latency, as long as all the DCs were doing were authentication but I doubt pushing GPOs and other AD functionality would work that well . 1
TwistedHelixis Posted October 19, 2018 Author Posted October 19, 2018 Why don't you go fully Chromebooks for staff and Students?... Would love to have 100% chromebooks, but I know it's going to be a slow progression. It has taken ages to move them over to the cloud, so will need to plan for Windows machines being on the network for a while longer. Are there legacy applications that you use only on Microsoft OS?.... Thinking about that I will need to check if Smart Notebook works from a Chrome device as they have Smart TVs. So it is looking like I will need to get a small onsite server for DNS, DHCP & GPO, at least for the foreseeable future. Thanks for the advice so far :0)
jmak Posted October 19, 2018 Posted October 19, 2018 Thinking about that I will need to check if Smart Notebook works from a Chrome device as they have Smart TVs. It doesn't.... There is SmartNotebook Express which is online.... and need flash Smart Learning Suite Online let's you open and use notebook files on any device, but you can't create them... 1
TwistedHelixis Posted October 20, 2018 Author Posted October 20, 2018 Just a thought, what if we did not need GPO and I removed the clients from the domain? That just leaves DHCP + DNS. Unfortunately we can't use Smoothwall or our router for these as they are controlled via the Local authority, although thinking about it I could point the clients DNS IP directly at our LAs DNS server and that 'should' work. So potentially I just need DHCP. Now when I had a server go down for a bit I ran the free version of this software on a desktop - https://sourceforge.net/projects/dhcpserver/ it seemed to be fine for the few days the school were using it. Ideally I would like to run both DNS and DHCP internally, does anyone know of any easy to configure software for doing this, or something hardware based?
Blue_Cookeh Posted October 20, 2018 Posted October 20, 2018 (edited) This is the way I'm moving our primary school. We currently have two DCs, a DirectAccess server, SCCM server, and a couple of others for things like monitoring/backup/digital signage sat on x3 Hyper-V hosts. I'm slowly killing off internal features with the view to go 100% cloud based and get rid of the servers in the next 5 years. We're at the stage now where file shares are in Office365 Sharepoint and personal files are OneDrive with FoD. My next plan is to implement Microsoft Intune on our Windows devices (already using it for iPads) so I can wind down Group Policy and use AutoPilot for device deployment. This will just leave Active Directory. I'm undecided whether to move entirely to AzureAD or just sit a standard DC in Azure with a site to site VPN. We'll probabably just go full cloud and stick with AzureAD - it's becoming a full replacement for ADDS slowly. Even if we had to stand up a full ADDS server in Azure then the cost of that is tiny compared to the cost of time/hardware etc. DHCP and DNS can then just sit on our core router (or use isc-dhcp-server on Linux @TwistedHelixis) and filtering done via SchoolsBroadband. We might keep one Linux server around for monitoring/CCTV/other bits. Edited October 20, 2018 by Blue_Cookeh
jmak Posted October 20, 2018 Posted October 20, 2018 This is the way I'm moving our primary school. ....... We're at the stage now where file shares are in Office365 Sharepoint and personal files are OneDrive with FoD. I have a similar ambition. Slightly off topic: how do you present the O365 SharePoint to users? Do they still access files/folders through Explorer? And if so, do they choose which ones to sync (on each machine they use using FoD) or do you map them somehow?
Zoom7000 Posted October 20, 2018 Posted October 20, 2018 This is a similar situation I've got at my MAT. We have no data onsite and our MIS is Bromcom, finance is PS Financials. We still have a legacy DC, only because we have Windows PCs and we aren't gonna throw them out of the window just yet. The biggest challenge we've got currently is: Print Management (PaperCut) Door Access Control (Paxton NET 2) Visitor Management (SG World & Inventry) I can't yet see a way to get past having some sort of box (or DC) onsite without going Azure, which is far too expensive. DNS and DHCP we do through our layer 3 Meraki switch.
Blue_Cookeh Posted October 20, 2018 Posted October 20, 2018 I have a similar ambition. Slightly off topic: how do you present the O365 SharePoint to users? Do they still access files/folders through Explorer? And if so, do they choose which ones to sync (on each machine they use using FoD) or do you map them somehow? I've shown them the ways they can access it (through individual office apps, through the website, or adding it to their Explorer side bar by hitting the Sync button in SharePoint and choosing what they want to keep local) and they all manage it themselves. Before we deployed it I did play around with mapping it to a drive letter but it's not particularly clean and wouldn't really fit in with the whole web/cloud first thing. It was a pain in the butt to manage because it relied on scripts running at logon. 1
mavhc Posted October 20, 2018 Posted October 20, 2018 Why the obsession with getting rid of servers? You have many computers running in your network cabinet, you just call them switches or routers or firewalls, what's one more? 1
jmak Posted October 20, 2018 Posted October 20, 2018 I've shown them the ways they can access it (through individual office apps, through the website, or adding it to their Explorer side bar by hitting the Sync button in SharePoint and choosing what they want to keep local) and they all manage it themselves. Before we deployed it I did play around with mapping it to a drive letter but it's not particularly clean and wouldn't really fit in with the whole web/cloud first thing. It was a pain in the butt to manage because it relied on scripts running at logon.Thanks. That's essentially how ours is set up, but it's been pretty unpopular. I think it's change that's the problem rather than being fundamentally wrong. We also have Teams, which I do think is rubbish.... Fine if you only open or work in MS Office files, but unintuitive for anything else. I am thinking of putting together a webpage with direct links to SharePoint libraries, but I'd have to set up a variation for each combination of user rights so that people only see the folders they have access to. It's what Teams should do, but it's awful to use.
mavhc Posted October 20, 2018 Posted October 20, 2018 Not sure why people went with Office 365 when GSuite is way better, and they have no incentive to make you upgrade to a desktop version 1
jmak Posted October 20, 2018 Posted October 20, 2018 Not sure why people went with Office 365 when GSuite is way better, and they have no incentive to make you upgrade to a desktop versionIt wasn't my recommendation.... Just trying to make it work. I tested and demo'd both and I'm still using Google Drive, Docs and File Stream for my work [emoji57]
Blue_Cookeh Posted October 20, 2018 Posted October 20, 2018 (edited) Not sure why people went with Office 365 when GSuite is way better, and they have no incentive to make you upgrade to a desktop version What a completely nonsensical statement. They both do different things well but the fact is most users know how to use Office and the integration between Windows/Office and Office365 is second to none. Our office and business managers would murder me if I took away Excel in favour of Google Sheets. There isn't "an obsession" with getting rid of servers either - I very much see the need for them in large organisations and even large schools but for primary schools (from those that rely on one server to more technically advanced ones like ours) they're complicated, expensive, and a pain in the ass to manage when most don't have full time technicians. I think if you're of the opinion that the cloud is big and scary then you'll be very quickly left behind in the IT world. Teams has a long way to go yet, we're using it in the NHS extensively now for IM and voice comms. Edited October 20, 2018 by Blue_Cookeh
TwistedHelixis Posted October 21, 2018 Author Posted October 21, 2018 Our office and business managers would murder me if I took away Excel in favour of Google Sheets. HMRC use Google and I think they probably use sheets just a bit - :0) They both do different things well but the fact is most users know how to use Office and the integration between Windows/Office and Office365 is second to none.] Yes but I would not purely base all my back end systems on the fact a user already knows on piece of software. Things change and our users need to be able to adapt. You can also use the save to Google feature in Office desktop or use Google File stream and continue using Office for a while if needed. BTW Google File Stream actually has better and simpler integration with Windows than Microsoft manages with it's own systems. The way I have got my staff using Google apps ( at some primary school ) was to initially use Google File Stream, which gives the end user a mapped drive. The end user at that point just keeps using all the software they normally use. Then over time I have pointed out that if they used XX Google product rather then Word or Excel, it might not do XX but look it can do this & this & this etc. All the staff have then basically been migrating themselves from Office to Google Apps, Admittedly this is in a primary school setting which will be different.
mavhc Posted October 21, 2018 Posted October 21, 2018 Most users are pupils, they know nothing, that's the point of school. If you are using cloud storage your server requirements are very different, don't need some massive "server", any solid state tiny box will do, everything has Gb networking and can run hyperv now, buy 2 if you're bored 1
mavhc Posted October 21, 2018 Posted October 21, 2018 I think if you're of the opinion that the cloud is big and scary then you'll be very quickly left behind in the IT world. 6 chars 1
Opendium_Steve Posted October 23, 2018 Posted October 23, 2018 If you have 802.1x authenticated wifi, this needs to be backed by a RADIUS server. The RADIUS server needs to be backed by a directory server, and last time I checked, Gsuite couldn't be used for this purpose. So you may need to keep a local directory server for that. (Note, I think the passwords on your AD server can be synchronised up to Gsuite but not the other way around). And if you take your workstations off the domain, I would imagine that your web filter wouldn't be able to do single signon to identify the users.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now