Cost effective Licensing

[chromeadler]

Hello,

 

I am looking to install a Windows Server 2019 on-site to have DC, DHCP, File/Print services, NPS/RADIUS with the possibility of creating VMs for each of the roles.

 

Population of users will be for a college of 500 - 2000 users.

 

I am looking at Win Server 2019 Standard but noticed that I will have to purchase CALs and OSEs as well. What would be a cost-effective licence to purchase to meet my requirements?

 

Thank you.

[mavhc]

a) Get licences for Server 2022, and still install 2019 if you wish

b) there's no point spending more to over complicate things, you get 2 licences by default, so put everything except printing on one, as printing is a security nightmare microsoft should be paying you to use, don't give them more money to make up for their terrible programming, that'll just encourage them.

 

You can licence by computer or by user, no technical difference, do both calculations and see which is cheaper, student only users and devices get a massive discount, something like 75p/user or student only computer.

[jmak]

What other Microsoft licensing are you using? If you're using Office or Office 365 it'll be worth looking at an OVS agreement. Some of them include server CALs.

[PotNoodleTech]

Sounds like it would be better to get one datacentre license as you can then create as many standard guests VMs as you wish as no extra cost.

[mavhc]

Sounds like it would be better to get one datacentre license as you can then create as many standard guests VMs as you wish as no extra cost.

 

Except for the extra cost of the datacenter licence

[PotNoodleTech]

Except for the extra cost of the datacenter licence

 

Yes but you include/absorb that extra cost as part of the server upgrade cost, and then you shouldn't have to buy any other server licenses so no nasty surprises to take to SLT when you want to create that WSUS server you thought you wouldn't need.

[mavhc]

No one needs a WSUS server any more.

 

It's not like Windows can't run multiple things at the same time anyway, best practise is to give as little tax money as possible to giant corporations

[kingoranks]

I binned my WSUS last yr, one less server to worry about

[PotNoodleTech]

No one needs a WSUS server any more.

 

It's not like Windows can't run multiple things at the same time anyway, best practise is to give as little tax money as possible to giant corporations

 

Lol it was an example of the possible inflexibility of running standard licences. Frankly we need even more update caching here, google os updates, adobe creative cloud updates, 1500 devices - the need for update servers is greater than ever!

 

So your an "install everything on the domain controller" to save money type huh? Most of the schools I've ever seen incur large amounts of downtime have had systems set up like that.

[mavhc]

Pretty sure AD/DNS/DHCP/File Sharing can all work on one VM without needing to have large amounts of downtime. What was causing their downtime?

 

ChromeOS can be cached with squid on linux apparently

[PotNoodleTech]

Pretty sure AD/DNS/DHCP/File Sharing can all work on one VM without needing to have large amounts of downtime. What was causing their downtime?

 

ChromeOS can be cached with squid on linux apparently

 

Really? I am a linux n00b but will look into that as we're downloading gigaquads of chrome and app updates and adobe is not much better but apparently, there is a way to cache that too.

 

Cache training...er I mean youtube videos here we come!

[mavhc]

Adobe will cache to Apache, but it seems like the actual downloader of the data is Windows or Mac, can probably mount the linux cache dir remotely though.

[chromeadler]

What other Microsoft licensing are you using? If you're using Office or Office 365 it'll be worth looking at an OVS agreement. Some of them include server CALs.

 

We just recently subscribed to the Microsoft 365 Education A3 package on a 1:40 licence ie for every staff, we were given 40 free licenses for students.

Edited May 26, 2022 by chromeadler

[highsky]

Chest framework?

[KK20]

I have tried 3 times to sign up to chest. Not once have they gotten back to me, my emails have gone unanswered. I even check 365 logs to make sure 365 isnt eating them. Ive tried with our .sch.uk and our .co.uk without issue. We are a genuine secondary school!

 

You say College so thats an education set of license. Im assuming that you will be running a cluster rather than a single host with no redundancy. Next look at how many VMs you want. 10VMs is around the breakpoint for std over dc. Each std license gives you 2 vms. DC gives you as many as you like. CALS depend on your desktop licensing model, you are better talking to someone (we use VeryPC, they were helpful running through scenarios and I got ZERO hard sell which wins in my book). It will depend on how you license your office, your OS as there are deals to be had with both. Or just purchase CALs.

 

Linux doesnt consume a license if you are using std over DC by the way. With clustering you need to license as if you had one host then multiply that by total number of hosts - you cant say "i'll have 5 VMs on this clustered host but only 2 VMs on that clustered host" it would be 7VMs worth (4std licenses) multiplied by two hosts (so 8 std licenses total). With EES OVS you get the latest version and utilise downgrade rights so you would be purchasing 2022 licenses and downgrading to 2019.

 

I must be one of the few people who have WSUS working without issues. I do keep the data clean on it though. I learnt what the AdamJ scripts did (before all the hoo haa) and created my own as part of the server update scripts.

Edited May 27, 2022 by KK20

[chromeadler]

Chest framework?

 

No chest framework as I am based in the Oceania region.

[jmak]

We just recently subscribed to the Microsoft 365 Education A3 package on a 1:40 licence ie for every staff, we were given 40 free licenses for students.

That's one of the ones that does include the CALs. I also got a quote for a server licence recently. I'm not allowed to share my quote, but think just over half of what you paid for one M365 Education A3 staff subscription for a Server Standard licence for 16 cores one year licence (minimum speed you can buy) which allows you to run one hypervisor with 2 VMs.

 

M365 Education A3 also includes Intune for Education and Azure AD P1, so everything you need to run WUfB if you don't want a WSUS server.

[snagrat]

That's one of the ones that does include the CALs. I also got a quote for a server licence recently. I'm not allowed to share my quote, but think just over half of what you paid for one M365 Education A3 staff subscription for a Server Standard licence for 16 cores one year licence (minimum speed you can buy) which allows you to run one hypervisor with 2 VMs.

 

M365 Education A3 also includes Intune for Education and Azure AD P1, so everything you need to run WUfB if you don't want a WSUS server.

 

It doesn’t give students the CALs, only the Staff

[dmj]

Hello,

 

I am looking to install a Windows Server 2019 on-site to have DC, DHCP, File/Print services, NPS/RADIUS with the possibility of creating VMs for each of the roles.

 

Population of users will be for a college of 500 - 2000 users.

 

I am looking at Win Server 2019 Standard but noticed that I will have to purchase CALs and OSEs as well. What would be a cost-effective licence to purchase to meet my requirements?

 

Thank you.

 

DC. = Samba4

DHCP = DHCPD

DNS = BIND9

FILE/Print = SAMBA/CUPS

RADIUS = FREERADIUS

VM's. = kvm/libvirt

 

Licensing = £0

[KK20]

do you actually run that setup? Hats off if you do in a windows environment. When we were transitioning from 2008R2 to 2012R2 (when 2012R2 was the latest) I looked and tried moving to a linux server infrastructure for some core services and I wasnt very successful. First, the DC was a no go as GPO domain replication always seemed to be out of sync on our test bed subdomain, I had everything setup as per the paper, I didnt confuse ID, it *should* have worked but didnt. DNS worked, DHCP worked, CUPS just didnt, RADIUS and VPN I didnt try as we used SSTP at the time so it made sense to leave our setup alone for that. Hypervisor was a windows hyper-v (for the linux containers) only because I was familiar with the setup, I didnt try a linux hypervisor.

 

Whilst I cannot replace MSSQL fully due to reporting services, I do have a very limited setup that did reduce the licensing costs to the bare minimum - cheaper than the online offering for our services that need it. The rest of our SQL is running on MariaDB VM. SIEM is ELK/ElasticAlert and runs nicely - this was one of the driving forces as I cannot afford the big boys and I needed it to be automated. PFSENSE is relatively turnkey.

 

In all honesty, for the man-hours I would have spent keeping a "free" linux infrastructure up vs the 4xDC licenses I pay (I cannot remember the last time I needed to work on the infrastructure to fix an issue with File, DNS, DHCP, RADIUS services - the printer v3/v4 driver issue was the last I needed to "fix") means I would be out of pocket overall and I am confident in my knowledge, securing a linux environment would mean I should really get a specialist to get it running thus putting the cost way out of scope.

 

Kudos if you did get it all working reliably, I certainly dont have that skillset to move to production!

[Mr.Ben]

Hard agree with @KK20

 

I can see the point in business, where licences cost the earth.

 

In Education licencing is so cheap it's sometimes inefficient to not run Windows Server (I'm not endorsing it, other OSs can be as reliable given time and resource, both of which we don't have).

 

I'm spending less on licencing (running 15 4 core VMs in Azure - 30 standard 2 core packs at £20 each, total £600 p.a in licencing costs) than I would in tech time setting up and maintaining open source equivalents.

 

I'm spending £18k in other Azure fees a year, but for 36 schools that less than the power cost and replacing 6 servers a year (we are completely server-less now)

[dmj]

do you actually run that setup? Hats off if you do in a windows environment. When we were transitioning from 2008R2 to 2012R2 (when 2012R2 was the latest) I looked and tried moving to a linux server infrastructure for some core services and I wasnt very successful. First, the DC was a no go as GPO domain replication always seemed to be out of sync on our test bed subdomain, I had everything setup as per the paper, I didnt confuse ID, it *should* have worked but didnt. DNS worked, DHCP worked, CUPS just didnt, RADIUS and VPN I didnt try as we used SSTP at the time so it made sense to leave our setup alone for that. Hypervisor was a windows hyper-v (for the linux containers) only because I was familiar with the setup, I didnt try a linux hypervisor.

 

Whilst I cannot replace MSSQL fully due to reporting services, I do have a very limited setup that did reduce the licensing costs to the bare minimum - cheaper than the online offering for our services that need it. The rest of our SQL is running on MariaDB VM. SIEM is ELK/ElasticAlert and runs nicely - this was one of the driving forces as I cannot afford the big boys and I needed it to be automated. PFSENSE is relatively turnkey.

 

In all honesty, for the man-hours I would have spent keeping a "free" linux infrastructure up vs the 4xDC licenses I pay (I cannot remember the last time I needed to work on the infrastructure to fix an issue with File, DNS, DHCP, RADIUS services - the printer v3/v4 driver issue was the last I needed to "fix") means I would be out of pocket overall and I am confident in my knowledge, securing a linux environment would mean I should really get a specialist to get it running thus putting the cost way out of scope.

 

Kudos if you did get it all working reliably, I certainly dont have that skillset to move to production!

 

Before moving to industry I worked in a University with 25,000 users using BIND,DHCPD which were integrated with AD controllers. There were some plans afoot to replace the AD controllers with Ansible and remove GPO completely but I left before any discussions took place. All the file/print sharing were managed by a pool of six samba servers running on ZFS. The trick with Samba/CUPS is to use the windows drivers on a samba partition - windows clients don't know the difference. The site wide wifi was managed by FreeRadius. SAML SSO was handled by shibboleth. Its quote common for larger organisations to have a lot of free software managing infrastructure. At a previous school I've also ran a FreeRadius wifi setup along with DHCPD, samba for filesharing and a KVM/Libvirt setup for virtualisation, and used a samba domain controller for an offsite location.

 

It's certainly possible to run this kind of setup in very large organisations, but if you're a one man band with little experience, then paying the microsoft tax would be an easier ride.

Edited May 31, 2022 by dmj

[Mr.Ben]

I think the choice is 100% about resources, and it is getting harder in the 5-18 education sector.

 

15 years ago in a single secondary with 8 primaries we had 5 staff and plenty of time to invest in open source solutions - Back in the early 2000's I can remember my joy at getting VMWare working as it cut the time to test software deployments by 95% (We ran Novell NetWare at the time in the dark days before MDT), and our thin clients running on Ubuntu were a great use of old kit.

 

Now I have 5 staff for 37 primary schools. Some things are more efficient (no servers is a great thing when you can get there), but with that many schools all of my time is taken dealing with operations rather than the tech side - that leaves 4 staff - One helpdesk lead, one technical lead and two field techs.

 

Almost 1/3 of time is travelling for the three techs, so in reality it's only 4 members of staff total.

 

We can't afford pay rates for staff with appropriate knowledge that would give me or the board confidence that we could manage open source efficiently.

 

If I could attract staff (we are across the West Country) and pay them appropriately the difference in pay would be significant compared to our Microsoft licensing bill.

 

It's a sorry state of affairs that we don't have the resources that we need, but we are all doing our best with the resources we have.

 

That uni job sounds like it was a great place to work!

[mavhc]

You can run WUfB without any licencing, it's free.

 

MSSQL can run on Linux

 

Proxmox with Ceph for HCI

 

Promox using ZFS for incredibly simple backups, I have hourly, daily, weekly and monthly incremental backups that integrate on the receiving backup server that also runs zfs, functionally indestructible and ransomware proof

[KK20]

do you use proxmox for HCI? I had looked at alternatives to hyper-v clustering (licensing would be the same as the VMs would be windows servers) but looking at various options for HCI over 3 or 4 nodes. Other options were S2D, starwind+hyper-v cluster or carry on with the stretch cluster 4 node + 2 SANs.

 

I will admit I hadnt heard of proxmox VE HCI (or ceph) so will have alook at that and their support pricing. Starwind was very expensive for a 4 node solution (yes 3 node is free with forum support) but I had a nightmare of a time with our testbed resyncing at inopportune moments (unless you disabled caching and take the performance hit) S2D was the fastest but also least flexible with hardware.