The road to a server-less school

[CyBeRkId2002]

Ok. We are currently migrating all of our schools to a single tenency and are moving along the road to management of devices (staff devices predominantly, but likely to extend to students) using Intune. The goal is as little reliance on infrastructure in our primary schools as possible.

 

At present our position is:

 

• Schools have what can be described as 'average' internet at best. These are rural schools and having investigated costs of better, more reliable connections these are just prohibitively expensive. As such I think DHCP / DNS needs to remain local at present.
  
• We are on the journey to moving everything to OneDrive / Sharepoint and are 99% of the way there! None the less having a server on-site with shares whose permissions integrate with Azure AD would be ideal. How have others gone about this? Do I simply create a VM and Azure AD join it?
  
• Print servers - how are people handling these? Again, is it possible to somehow join a local server to Azure AD and manage permissions this way
  
• 
  

 

Looking for tips on the above to help us on the way to a server-less infrastructure.

[Jcx500]

When my old place moved to sharepoint / OneDrive , we still had on prem AD.

 

We had a small FS with a 100mb quota where we did our folder redirects. Then we use cloud mapper to map our OneDrive and encouraged people use that ( well they did lol what is a 100mb)

[slugshead]

Tell them you're "bringing the cloud to you" and slam a hypervisor/SAN in there

 

Insert every HPE Greenlake quote here

[nicholab]

We have onsite AD running on servers in Azure I would still run AD on a box under your control. Running in the cloud makes DR easier. You can also get VPN to azure included in one of the E licences. Have any schools gone Amazon?

 

 

Mapping to OneDrive a drive letter is definitely worth it due to legacy software used in schools.

Edited April 5, 2022 by nicholab

[Michael]

There's an article about this here

[ThatBoringBloke]

Take a look at this site:- https://blog.theserverlessschool.net/

[CyBeRkId2002]

Thanks all. I actually think, for our primaries, we can get away with the requirement for on-site file shares entirely and move solely over to OneDrive / Sharepoint - no need for network drive mapping as pretty much all software they currently use (that is essential) is cloud-based.

 

I suppose this only leaves DHCP, DNS, Printers. I presume I could stand all of this up without the need for AD. With regards the printers am I right in thinking my options are:

 

• Setup a print server and enable print to Everyone (as they won't be able to authenticate)
  
• Set them up as Direct Print
  
• Investigate Microsoft Universal Print and print the way Microsoft wants us to
  

 

Am I missing anything else crucial if I do away with on-site AD? My other option at this point is to join them to a domain centrally (I have actually setup a new Domain specifically for this) but as broadband is limited I would want Auth / DNS / DHCP locally I presume I would need to join a DC at each site. Would this be bad practice (having approx 9 DC's in total?)

[CyBeRkId2002]

We have onsite AD running on servers in Azure I would still run AD on a box under your control

 

Sorry, just wanted to clarify this... I presume you don't mean on-site - but cloud?

 

My concern would be what happens if braodband connectivity goes down. Doesn't happen frequently - but does happen.

[slugshead]

connectivity goes down. Doesn't happen frequently - but does happen.

 

That's why at a very minimum you run an on site AD, even if it's a replica to still provision logons.

 

Using radius? Another very minimum, to have running one copy of NPS on prem too

 

Small file server on site to host home folders or you're going to have those temp profile issues

[ThatBoringBloke]

That's why at a very minimum you run an on site AD, even if it's a replica to still provision logons.

 

Using radius? Another very minimum, to have running one copy of NPS on prem too

 

Small file server on site to host home folders or you're going to have those temp profile issues

 

Why not look at redundant Internet connectivity? I have heard of Business 5G offerings, which could in theory provide a robust backup to a SaaS setup.

[IT_JB]

We went serverless over a year ago across our 11 sites. 0 onsite severs, azure AD only, files in onedrive and sharepoint with KFM enabled for redirection. It's been a very successful move for us, i'm happy to go into more details on each element of the move if that's useful, just drop me a PM.

 

 

• Schools have what can be described as 'average' internet at best. These are rural schools and having investigated costs of better, more reliable connections these are just prohibitively expensive. As such I think DHCP / DNS needs to remain local at present.
  

 

We were in a similar situation with a number of rural primaries but after monitoring the bandwidth at each site over the last year we are yet to max out at the sites which only have FTTC lines. DHCP was moved to the router and there was no longer a requirement for local DNS with no services running from site.

 

 

• We are on the journey to moving everything to OneDrive / Sharepoint and are 99% of the way there! None the less having a server on-site with shares whose permissions integrate with Azure AD would be ideal. How have others gone about this? Do I simply create a VM and Azure AD join it?
  

 

Sure you could have a file server onsite but i think you would quickly wonder why you bothered. Synced locations from SharePoint give staff the same shared folder experience and the performance is on par with local. Maybe if you are working with large media files, this would be the only case i would consider it worth while.

 

 

• Print servers - how are people handling these? Again, is it possible to somehow join a local server to Azure AD and manage permissions this way
  

 

We tried universal print but there is still a requirement for an onsite server/machine to run a connector. There are only a handful of machines that have native connectivity to universal print. Other options would be printix & papercut hive if you need pull printing. Printerlogic if you just need printer deployment and management. With any of these options you don't need an onsite print server.

[Disease]

How does everyone feel about this when Google is reducing free storage and MS will probably do the same at some point, once everything is moved to the cloud you are at the mercy of the providers not deciding to massively increase costs overnight?

[jmak]

@IT_JB

What do you use to run DHCP/DNS? Did you manage to get away from Windows server for that?

Thanks

[CyBeRkId2002]

@IT_JB

What do you use to run DHCP/DNS? Did you manage to get away from Windows server for that?

Thanks

 

DHCP was moved to the router and there was no longer a requirement for local DNS with no services running from site. (from the above)

[Michael]

DHCP is easy enough to achieve on your gateway, most likely your filtering/firewall appliance. I still prefer Windows DHCP Server though as it's more granular.

 

DNS there's a few options -

 

Either point to say Google DNS if you're fully Azure, or alternatively specify internal DNS to your core, which then would go out to Google DNS.

[Sonic007]

So file shares are easy to take to the cloud but how are you guys doing printing?

[robyholmes]

So file shares are easy to take to the cloud but how are you guys doing printing?

 

Personally I'm keeping an eye on Papercut Hive to see when it starts to include all the features (Or all the ones we use) of Papercut MF.

[snagrat]

So file shares are easy to take to the cloud but how are you guys doing printing?

 

We use Printix. Works with Papercut and just works with no user intervention

[chaplic]

So file shares are easy to take to the cloud but how are you guys doing printing?

 

 

I took my school serverless. We just do printing via direct IPP, so printing to the IP address of the printer. Only teachers print so it's quite small setup, but works well enough

 

DHCP I didn't have any kit that would run DHCP, so this runs on the admin PC (which also runs sims) and on a little NUC device that also runs prtg for monitoring. uses software from dhcpserver.de which works like a champ and the fella even fixed a bug I reported. Also provide a lightweight dns and webserver which can be handy for pac files.

 

As it's a primary loss of broadband is perhaps not as fatal, but teachers have email etc on their phone.

 

It's made most use cases in the DR plan very straightfoward!

[jmak]

At my last school I set up dhcpserver.de on the admin PC as a backup as we only had a single server to run all roles, so it was part of my emergency plan.

 

Once we replaced the file server with M365 my main emergency plan was mobile phones as hotspots!

[Shadow_Walker]

Few of our schools are already serverless. For DHCP best option we found was using a layer 3 switch to do this.

[mrstrong]

we use smoothwall on site (firewall web filter/proxy) and it can do dhcp if needed (instead of a windows server)

[TechMonkey]

Personally I'm keeping an eye on Papercut Hive to see when it starts to include all the features (Or all the ones we use) of Papercut MF.

Do we know what is missing from Hive? Looked at their product page and their didn't seem to be a comparison matrix.

EDIT: Doh, never mind. Found it.

Compare Products

[robyholmes]

Do we know what is missing from Hive? Looked at their product page and their didn't seem to be a comparison matrix.

EDIT: Doh, never mind. Found it.

Compare Products

 

Once shared accounts is added, it won't have much major missing by look of it, as long as your MFD manufacture supports Hive (Mainly around scanning)