Domain Names for MAT

[TJ-Diggers]

Looking to build my MAT network with a MAT central network and each school as a subdomain and debating to use my MAT website domain for the names. Has anyone else done this or stuck with .local etc. I have read that there is sometimes some issues.

 

the main reason i want to use the mat website domain so the upn are set to that by default. I know i can add an additional upn suffix and change it but though this might be easier.

 

Forest Root - mat.co.uk

Sub domain - school1.mat.co.uk

Sub domain - school2.mat.co.uk

Sub domain - school3.mat.co.uk

 

Or should i go with

Forest Root - mat.local

Sub domain - school1.mat.local

Sub domain - school2.mat.local

Sub domain - school3.mat.local

[Primus]

Don't use .local - use an actual domain name you own - some people like to prefix the domain with internal. for AD - some prefer to just use the domain as is.

 

Eg. you could use internal.mat.co.uk or just mat.co.uk.

[HPlum78]

Go with a resolvable address, using a .local address with split brain DNS just adds an administrative overhead and is largely discouraged now.

[computer_expert]

The advice I see and give out is to use a subdomain of a domain name you own. I'd go for the first option as .local can cause issues with MDNS as that also uses .local

 

For example:

 

Forest root: ad.mat.co.uk

sub domain: sch1.ad.mat.co.uk

sub domain: sch2.ad.mat.co.uk

 

Just be aware if you use mat.co.uk as the FR and have a website on mat.co.uk, then you'll have to do some additional work to get the site working internally (as the doman will resolve to your DCs instead).

 

I'd also take note of @localzuk's post below - it will reduce complexity (less domains, less admin, less DCs (less server licences/cost) etc)

Edited March 1, 2021 by computer_expert

[localzuk]

We have a single domain across all our schools (we couldn't see any value in creating actual subdomains for each school).

 

We bought a new domain just for this task, and then created a subdomain of it for the AD domain. eg internal.domain.tech etc...

[TJ-Diggers]

This is the issue I have been reading about. Although this is additional work is there a lot to configure?

 

Just be aware if you use mat.co.uk as the FR and have a website on mat.co.uk, then you'll have to do some additional work to get the site working internally (as the doman will resolve to your DCs instead).

[Chaniel]

This is the issue I have been reading about. Although this is additional work is there a lot to configure?

 

Having your internal and external domain name the same will mean you have split DNS. This is why the current best practice is to use "ad.mat.co.uk" rather than "mat.co.uk".

 

It's not that much work to configure, but it's an extra bit of administration that isn't really necessary if you're starting from scratch.

 

To try to make an example;

 

1) Computer on your domain tries to access http://www.mat.co.uk, it queries one of your DCs for the IP address

2) Your DC has a lookup zone for mat.co.uk (as it's the AD domain) so it looks for the host www

3) Can't find the host www - returns "not found"

4) Computer doesn't load the website

 

To get around that, you'd have to make a record in your DNS zone for www and point it to the websites IP address manually

[Michael]

We have a single domain across all our schools (we couldn't see any value in creating actual subdomains for each school).

 

We bought a new domain just for this task, and then created a subdomain of it for the AD domain. eg internal.domain.tech etc...

 

That's how I've done it too - a single properly named domain in a forest, with each school in its own OU.

 

All user and computer objects then belong under this OU. It also makes it easier/simpler to share the same GPOs where possible instead of doubling up on work.

 

Each site still has its own subnet, but it's just a case of creating some reverse DNS zones and everything then just resolves as expected.

[pete]

For those of you using single domains across the trust, are computer names asset IDs or service tags? Or do you prefix names with site initials?

[Jonah]

That's how I've done it too - a single properly named domain in a forest, with each school in its own OU.

 

All user and computer objects then belong under this OU. It also makes it easier/simpler to share the same GPOs where possible instead of doubling up on work.

 

Each site still has its own subnet, but it's just a case of creating some reverse DNS zones and everything then just resolves as expected.

 

This is also how we do things

[Jonah]

For those of you using single domains across the trust, are computer names asset IDs or service tags? Or do you prefix names with site initials?

 

We name them with a three letter prefix for the site, then the room, and type/number.

 

So ABC-F01-S01 is a staff machine in F01 at ABC.

 

We write the devices service tag (and make and model) to the AD description field when imaged.

[Jcx500]

Place I used to work did this

 

Single domain

 

Ou for trust

 

Ou for schools within trust ou

 

Ou for trust servers

 

 

Naming scheme

 

Site-roomname,device name/number

 

Server / infrastructure naming

 

Site1-dc01

 

Site1-core-sw

[Michael]

Any prefix of some kind is helpful, depending on how big your MAT is. Remember structuring your OUs properly, it isn't always necessary to specify the room. You could always label the OU the room.

[Sylv3r]

We use

 

schoolinitials.mat.com

 

For both each school network and their O365 domain.

 

All machines are schoolinitials-M1-01 all AD groups etc are prefixed with school initials-All Staff.

 

All user display names are Mr A Smith (School initials)

[XiJ]

I’ve just set a domain from scratch for a school that’s part of a MAT but was flooded and completely renovated.

 

Reading current best practice we went for

 

School.mat.org

 

 

It’s so neat to be able to start from scratch, have a decent rack mount server and all the same network switches etc (in a primary school).

[localzuk]

For those of you using single domains across the trust, are computer names asset IDs or service tags? Or do you prefix names with site initials?

Any servers/switches/APs/printers are named with a site code XXX-devicetype-YY eg. DMS-PRN-01

Client devices are named DEVAssetID eg DES27332123 or LAP47327622

 

Client devices have a habit of moving around, so there's no need to mark them geographically by their name - can see where they are by OU/IP/Description

[Jcx500]

For AD Names ive always done school initials then domain,

 

random school, rsdomain.mat.org.uk

[MatthewL]

One domain that is a real domain, update DNS appropriately, makes things far easier.

 

One domain for users using the same, this is where your OU's come into place i.e. ours is Domain.org.uk > Root > Organisation > Computers/Users/Groups/Servers etc. That way you can apply everything in one place, also staff likely to move around sites it will be seamless. Causing yourself headache having multiple domains to be honest.

 

Centralise services such as say if you use Unifi have 1 controller, use sites feature, 1 print server, save on licensing costs etc etc.