3s-gtech Posted July 26, 2019 Posted July 26, 2019 Before you embark, you need to update your terminology or you’ll deeply confuse yourself. No such thing as a PDC now. FSMO role holder.
SVM Posted July 26, 2019 Posted July 26, 2019 What would be the reason to move a DC into the "cloud" ? if its for backup if you are in a MAT you could use another school ?
dmj Posted July 26, 2019 Posted July 26, 2019 What would be the reason to move a DC into the "cloud" ? if its for backup if you are in a MAT you could use another school ? The justifications: Increased number of applications running in cloud - users were often authenticating from cloud providers Resilience against local environmental factors (power cuts, server shutdowns, flooding, nuclear armageddon, school moving etc) Space is at a premium and local server space is tight costs are more predictable, similar to MS schools agreement vs purchasing outright - it is easier to get a fixed cost paid for than arguing for new server equipment Reduced cost of virtualisation software onsite
owen1978 Posted July 26, 2019 Posted July 26, 2019 Before you embark, you need to update your terminology or you’ll deeply confuse yourself. No such thing as a PDC now. FSMO role holder. Thanks, Im bit old skool... I haven't come any schools that split the FSMO roles... so I still use PDC but in most cases one DC holds all the roles. 1
owen1978 Posted July 26, 2019 Posted July 26, 2019 What would be the reason to move a DC into the "cloud" ? if its for backup if you are in a MAT you could use another school ? Is just he way things are heading, feel more secure knowing its on Azure then held at another school
SVM Posted July 26, 2019 Posted July 26, 2019 I still think onsite is more cost effective, majority of providers are now supporting authentication with Azure AD or Gsuite, local environment factors you wouldn't be able to log in locally with a power cut as not on internet and Office365 can/works without a local DC available At the moment I think costs are too much for Azure, I expect Microsoft to drop prices in the next year or 2 to move us all over but for now I would say local servers are still the best route, we have setup our own mini "Azure" where we have all hyper-v servers on the same domain running across multi sites via VPNs, all in all around 100 VMs, putting them in the cloud would be quite expensive
dmj Posted July 26, 2019 Posted July 26, 2019 I still think onsite is more cost effective, majority of providers are now supporting authentication with Azure AD or Gsuite, local environment factors you wouldn't be able to log in locally with a power cut as not on internet and Office365 can/works without a local DC available At the moment I think costs are too much for Azure, I expect Microsoft to drop prices in the next year or 2 to move us all over but for now I would say local servers are still the best route, we have setup our own mini "Azure" where we have all hyper-v servers on the same domain running across multi sites via VPNs, all in all around 100 VMs, putting them in the cloud would be quite expensive I agree with monolithic applications like Active Directory. To get the massive cost savings that large companies enjoy you do have to do a certain amount of re-design to your infrastructure. Lots of people won't want to do the extra work, but if you can start subdividing your servers into containers and you will start seeing the benefit. I wrote about that here: http://www.edugeek.net/forums/cloud-services/207170-using-azure.html#post1775000
localzuk Posted July 26, 2019 Posted July 26, 2019 What would be the reason to move a DC into the "cloud" ? if its for backup if you are in a MAT you could use another school ? If your MAT is like ours, other schools don't *have* servers.
SVM Posted July 26, 2019 Posted July 26, 2019 Quite a few schools that join us always seem to come with 3 x Servers, a SAN and 2 switches which is overkill and a waste of resources for a single site, the servers get re-distributed as and when required, keeps us going with onsite servers until Microsoft drop Azure prices
DrCheese Posted July 26, 2019 Posted July 26, 2019 What would be the reason to move a DC into the "cloud" ? if its for backup if you are in a MAT you could use another school ? If you use Azure AD passthrough and you're a single site school then when your DC goes offline (unplanned) users can't authenticate until you raise a support ticket with MS to switch it over to password auth only (Which can take hours) so running a DC in the cloud mitigates that risk. If it's planned downtime you can do that yourself in advance - But ya if you have another physical site then that's an option of course.
mavhc Posted July 26, 2019 Posted July 26, 2019 Running print server in the cloud, does that mean everything that's printed is uploaded and then downloaded again over your internet connection? Or just the control data?
snagrat Posted July 27, 2019 Posted July 27, 2019 Running print server in the cloud, does that mean everything that's printed is uploaded and then downloaded again over your internet connection? Or just the control data? I know we are just about to put PaperCut in Azure which will mean everything is uploaded and then downloaded when released.
SVM Posted July 27, 2019 Posted July 27, 2019 If you use Azure AD passthrough and you're a single site school then when your DC goes offline (unplanned) users can't authenticate until you raise a support ticket with MS to switch it over to password auth only (Which can take hours) so running a DC in the cloud mitigates that risk. If it's planned downtime you can do that yourself in advance - But ya if you have another physical site then that's an option of course. If password hash sync is enabled in Azure AD connect you would avoid any downtime in Office365 if DC/site is down.
DrCheese Posted July 27, 2019 Posted July 27, 2019 If password hash sync is enabled in Azure AD connect you would avoid any downtime in Office365 if DC/site is down. No it doesn't work like that at the moment with passthrough support, it's a manual switchover process that if you don't do before the site goes down it needs MS to switchover. You're thinking of the older method with ADFS/SAML signin when you could powershell on yourself and switchover.
SVM Posted July 27, 2019 Posted July 27, 2019 It is one of the main reasons password hash sync was released, you auth against Azure AD rather than a local dc server for Office 365 services https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization Not sure on having passthrough support as I thought you had to pick one setup, passthrough or hash sync but not both
DrCheese Posted July 27, 2019 Posted July 27, 2019 Aye - Passthrough is needed for seemless SSO to work internally whereas if we used password hash sync then they'd have to enter their password everytime they hit an azure AD service.
SVM Posted July 27, 2019 Posted July 27, 2019 Password hash works the same way, we have sso for all Office365 services and onedrive client, if logging on with a domain account no passwords are required
DrCheese Posted July 28, 2019 Posted July 28, 2019 ah looks like you're right - Don't think it supported that properly when we rolled out passthrough. There's a few other differences (Signing in to other applications requires reauth) by the looks of it but those are hardly the end of the world. Difference between Federation, Password Hash Sync & Pass-Through Authentication | SHC Thanks, I might look into switching us over to just password auth going forward.
owen1978 Posted July 29, 2019 Posted July 29, 2019 I still think onsite is more cost effective, majority of providers are now supporting authentication with Azure AD or Gsuite, local environment factors you wouldn't be able to log in locally with a power cut as not on internet and Office365 can/works without a local DC available At the moment I think costs are too much for Azure, I expect Microsoft to drop prices in the next year or 2 to move us all over but for now I would say local servers are still the best route, we have setup our own mini "Azure" where we have all hyper-v servers on the same domain running across multi sites via VPNs, all in all around 100 VMs, putting them in the cloud would be quite expensive Hi, Just want to clarify this point in my head. If I have the PDC in the cloud and a read only DC on site. Power cut occurs... Won't devices use the on site domain controller for logon and authentication? Also am I missing something, Priced up a DC using the Azure VM calculator and it came to $42 a month - which doesn't seem to bad?
SVM Posted July 29, 2019 Posted July 29, 2019 Are you using Azure AD connect to sync to Office365 ? if so check what options you have enabled, if its password hash then a DC in Azure is not needed if purely down to having resillience if the site is down, if you have a power cut Office365 would not be affect as users get authenticated against Azure AD which is in the "cloud" If you are setup similar to DrCheese then you would need to setup 2 DCs with the agent on or I would suggest moving to password hash only, the only reason to keep with passthrough by the looks if it is security as its doesn't hash passwords to the cloud but then putting a DC in the cloud would probably defeat the extra security passthrough provides (probably mainly for banks etc) Hi, Just want to clarify this point in my head. If I have the PDC in the cloud and a read only DC on site. Power cut occurs... Won't devices use the on site domain controller for logon and authentication? Also am I missing something, Priced up a DC using the Azure VM calculator and it came to $42 a month - which doesn't seem to bad?
owen1978 Posted July 29, 2019 Posted July 29, 2019 Are you using Azure AD connect to sync to Office365 ? if so check what options you have enabled, if its password hash then a DC in Azure is not needed if purely down to having resillience if the site is down, if you have a power cut Office365 would not be affect as users get authenticated against Azure AD which is in the "cloud" If you are setup similar to DrCheese then you would need to setup 2 DCs with the agent on or I would suggest moving to password hash only, the only reason to keep with passthrough by the looks if it is security as its doesn't hash passwords to the cloud but then putting a DC in the cloud would probably defeat the extra security passthrough provides (probably mainly for banks etc) Sorry I am probably confusing the matter, what I am trying to understand in the setup of having a PDC in the cloud and a read only DC on the local network. If a power cut occurs, then will windows devices such as laptops, pcs etc.. will they not be able to log on using only the local DC. So what I mean is logon and still access network shares, print services, local applications even though the PDC is offline? I hope that makes a bit more sense
SVM Posted July 29, 2019 Posted July 29, 2019 Yes sorry bit confused - If you have a local power cut you wouldn't have access to servers with network shares / printing ? also would not have access to internet to access online services ? - but if its just your local DC has failed whilst other servers are running you would be able to logon via Azure DC as long as the vpn is still up to Azure If the Azure DC has issues then you would still authenticate against the local DC
owen1978 Posted July 29, 2019 Posted July 29, 2019 Yes sorry bit confused - If you have a local power cut you wouldn't have access to servers with network shares / printing ? also would not have access to internet to access online services ? - but if its just your local DC has failed whilst other servers are running you would be able to logon via Azure DC as long as the vpn is still up to Azure If the Azure DC has issues then you would still authenticate against the local DC My bad not power cut but if we lost internet connectivity, apologies
SVM Posted July 29, 2019 Posted July 29, 2019 In that case yes loss of broadband connectivity would still allow you to authenticate against local DC and access all your onsite services My bad not power cut but if we lost internet connectivity, apologies
owen1978 Posted July 29, 2019 Posted July 29, 2019 In that case yes loss of broadband connectivity would still allow you to authenticate against local DC and access all your onsite services So in terms of building a robust & resilient network having a PDC in the cloud and local DC's is a good way forward would you say?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now