Setting up new server

[SteveB_NI]

At present we currently have 3 servers running following roles:

 

Server 1 - DC, AD, DNS, DHCP, File Server, Backup

Server 2 - DC, AD, DNS, DHCP, WSUS, Anti-Virus, WDS

Server 3 - Print management, Applications hosting

 

I have a new server & I'm planning to combine all 3 old 2008R2 servers into 1, with HyperV VM servers for the existing 3.

 

Is there much benefit in Server 2016 (Edit - now testing with Server 2019) to keeping the 3 separate servers split as above, or should I look at more virtual servers and split them even more?

 

Also - I have split the hard drives into Raid formation so the 2 400GB SSDs are OS drives (direct duplication) and the 4 1TB SAS drives are in Raid 6 format. Should all virtual servers be installed on the OS SSD and use the slower 1TB drives for the file server only?

 

Thanks in advance

Edited February 3, 2020 by SteveB_NI

[Norphy]

First of all, if you only have four drives in the "big" array, I'd use RAID 10 rather than RAID 6 if your controller supports it. You get the same amount of redundancy and the same capacity but you don't get the horrible write performance loss through parity calculations.

 

Secondly, if have the licenses, I'd use Server 2019 rather than 2016. 2019 is just an evolution of 2016, it's been on the market long enough to be considered stable and it contains some fixes which won't get backported to 2016, such as a fix for the horrible amounts of time it takes to update the thing.

 

Again, depending on what your licensing looks like, I think it is probably worth splitting out the roles. A DC should be a DC and only hold DC related roles such as DHCP and DNS. I'd have a separate VM for the DCs, the file server, WSUS, AV and WDS. Print management could probably live quite happily on the file server.

 

The last thing I'd point out is that this is putting all your roles onto a single piece of hardware. It might be worth considering keeping one of your old servers as a DC, just in case.

[Sonic007]

If they are VM's then just make regular backups of the VM's. You won't need a backup DC unless you really cant afford to be down for a few hours.

[SteveB_NI]

Thanks for your replies - we have licenses for Server 2019 so that's covered. I was just running with Server 2016 as it's better documented etc but I agree would be better future proofing with Server 2019.

 

Re: the roles split up - so would you recommend

 

VM 1 - DC, AD, DHCP, DNS

VM 2 - DC, AD, DHCP, DNS

VM 3 - File server, Print management, Backup

VM 4 - WSUS, WDS, AV

 

Or split VM4 up further?

 

RAID 10 should be ok too - I remember that was an option.

[Norphy]

I'd put WSUS on its own VM to be honest, it can be a CPU and memory hog.

 

Just be careful with MS licensing - Windows Server standard will only allow two VMs per host per license, so if you have more than two VMs you'll either have to get additional Standard licenses or shell out for a datacenter license. The datacenter license may be more economical depending on how many VMs you end up running.

[jthompson]

I like to keep DC VMs as lean and clean as possible and have things like WSUS and file shares handled by other VMs. Minimise the opportunity for things to foul up your DCs.

 

That obviously depends on how much storage you have available for running and backing up those additional VMs.

 

I'd also be tempted to have your backups run from something other than your DC. Perhaps the Hyper-V host or some different hardware, even if that's just one of your old servers with a fresh instal of 2016/2019.

[SteveB_NI]

Thanks for the tips - one quick question, when I'm setting up VMs, do you recommend the Virtual HDD is kept on the OS (SSD) drives, or on the Data (slower) drives?

 

Also - Mods - I've changed to Windows Server 2019 as per suggestion. Could this please be moved? Thanks!

[jthompson]

Personally, I'd prefer to have all of the VMs on the main storage array, separate from the host's system drive. Not as fast perhaps but seems tidier, especially if you decide/need to rebuild the host for any reason.

 

Probably fine either way, though, and you might prefer to make use of your SSD storage which would otherwise being going unused. You'll be backing up your VMs anyway in case anything falls over.

[Norphy]

do you recommend the Virtual HDD is kept on the OS (SSD) drives, or on the Data (slower) drives?

 

The issue is that 400gb isn’t a lot of space. Once you take into account the host OS and the amount of space you have to keep free to keep the thing running, your left with maybe 250gb free for VMs. That’s enough for one VM perhaps, depending on what it’s doing.

 

If it were me, I’d put something which uses a database on it, such as an MIS. Everything else can live adequately on spinning rust.

[Davit2005]

First I'd keep any third party software off Domain controllers from a security point of view and as @jthompson said as lean as possible

Keep Backup separate because of possible needed restarts

WSUS, WDS and AntiVirus on the same VM

Print Management on its own VM due to possible necessary restarts

File shares on their own VM

[XiJ]

I would Store VM’s on the ssd without question although I agree 400gb is a bit skinny. WSUS and maybe a candidate for storing in the mechanicals.

[SteveB_NI]

I've started putting the VMs on the SSDs, but will keep WSUS VM on the mechanicals - good idea.

 

Our needs are pretty low to be honest - 800 users, but MIS is held on another managed network, so this network only looks after the ICT suites & study areas.

 

The rest of the school - including all teacher / staff areas are on the other managed network side.

 

Hopefully therefore 400GB for the Host / VM drives should be sufficient... I have them set to dynamic storage sizes at present.

[mikkydoos]

WSUS really does not want to not be on a VM. It will eat ALL of your disk space in a short amount of time. Mines sitting at 250GB right now.

 

IMO, 2 SSD's isn't really going to give you a great deal of redundancy... not ideal, especially as they're SSD's.

 

 

As for the machines, mine basically go like this on VMWare. Aiming for minimal interruption if any one (particularly) production Windows VM needs to go down:

 

DC1, DC2, MIS, PRINT, WSUS, WDS, FILE, BACKUP (console) - all replicated across 2 hosts.

 

I'd also consider using virtual appliances for anything that you can. Very low CPU & disk footprints for your hypervisor. Also VA's might utilise your hardware a bit better.

 

VA's here are: Hypervisor console, UPS console, AV console. Saves a lot of wasted resources if we were using Windows.

Edited February 4, 2020 by mikkydoos

[CHiLL]

I like to separate VMs for their own roles and not mix them up if possible.

We have;

2x DCs

Staff file server

Student file server

Backup server

MIS server

Print server

SCCM server (SCCM also manages WSUS/SUP)

Biometrics server for cashless catering

2x servers for AD FS

2x servers for RDS/Gateway

Web server for HAP

VPN server for Always-On VPN

 

We do have a 'management server', which is the only server that has multiple roles. It controls Azure AD sync, Impero and SalamanderAD.

 

The reason I like to separate servers out is so I have minimal disruption if something goes wrong with that server or I need to restart it.

[jthompson]

For the WSUS VM, use a dedicated VHDX for the WSUS data itself. Don't have it storing all the updates on it's system drive. That means you can still have the VM system drive on the SSDs if you want, but the bulky WSUS data on your main storage array.

[mikkydoos]

For the WSUS VM, use a dedicated VHDX for the WSUS data itself. Don't have it storing all the updates on it's system drive. That means you can still have the VM system drive on the SSDs if you want, but the bulky WSUS data on your main storage array.

 

WSUS always fell over when I tried putting the updates on another drive... might try that again soon actually.

 

 

 

EDIT: come to think of it, I think I was trying to put the updates on a network share... thats probably why it fell over.