Serverless Schools..... is there a real option

[cwade1001]

So I am currently in a battle of an affordable serverless solution for schools, that will happily run with Google Workspace or M365. Azure AD, Teams, OneDrive, Intune, Google Drive etc... Printing solution: Printix or Papercut Hive, although apparently Printix teachers can not release student prints from a photocopier or PC? Apparently?

 

My real issue is DHCP/DNS Services.... Now I dont see a need for a local DNS in a standard primary school unless their is a specific piece of hardware or software that requires it. Which leaves me with DHCP.....

 

I have had several ideas.... a couple of schools have nice Meraki L3 switches thanks to Connect the Classroom project, others are running a standard HP Switch managed switch (some L3 some not) however the DHCP on HP Switches I am far from impressed with.

 

The schools feed is provided by our local county and sits behind a central firewall and filtering is provided centrally from the provider.

 

I have thought about Unifi Dream Machine Pro, Intel NUC running Linux etc.... what are people using out there in the world?

[dmj]

So I am currently in a battle of an affordable serverless solution for schools, that will happily run with Google Workspace or M365. Azure AD, Teams, OneDrive, Intune, Google Drive etc... Printing solution: Printix or Papercut Hive, although apparently Printix teachers can not release student prints from a photocopier or PC? Apparently?

 

My real issue is DHCP/DNS Services.... Now I dont see a need for a local DNS in a standard primary school unless their is a specific piece of hardware or software that requires it. Which leaves me with DHCP.....

 

I have had several ideas.... a couple of schools have nice Meraki L3 switches thanks to Connect the Classroom project, others are running a standard HP Switch managed switch (some L3 some not) however the DHCP on HP Switches I am far from impressed with.

 

The schools feed is provided by our local county and sits behind a central firewall and filtering is provided centrally from the provider.

 

99% sure the LA provided router / filtering will be capable of running DHCP. If they don't let you have root on it, have you asked them about whether they could configure/manage DHCP for you?

 

I have thought about Unifi Dream Machine Pro, Intel NUC running Linux etc....

 

Isn't that the same problem you're trying to get away from - managing an on-site server?

 

 

FWIW I did used to run a high availability DHCP that failed over to a server running in a cloud provider. It wasn't true serverless as I still had to manage that VM it did work well though.

 

I think you just need to be pragmatic about it, if you can't get a decent solution using the network equipment that you have (or can you reflash any of it with OpenWRT?), having a couple of raspberry pi's with a failover DHCP capability or the Unifi kit that you suggested would both be good options.

[chaplic]

I use dhcpserver.de DHCP server on a NUC that also runs PRTG and a second DHCP server on the SBMs PC which also runs sims. It also does basic web hosting which is handy if you have a need for proxy.pac. Everything else on-cloud.

 

Printing I just do IP printing direct to the printer, but it’s just for teachers.

[cwade1001]

Looked at the router, but from experience they are not the quickest for responses if changes are required.

[cwade1001]

I use dhcpserver.de DHCP server on a NUC that also runs PRTG and a second DHCP server on the SBMs PC which also runs sims. It also does basic web hosting which is handy if you have a need for proxy.pac. Everything else on-cloud.

 

Printing I just do IP printing direct to the printer, but it’s just for teachers.

 

Do you use just a standard Windows 10/11 OS on the NUC?

[dmj]

Do you use just a standard Windows 10/11 OS on the NUC?

 

You'd need server license/CALs to be compliant AFAIK.

 

NUC is overkill for DHCP IMO.

[gszech]

I'm in the same boat. I'm managing multiple schools and would like to remove all servers from primary schools.

We just migrated SIMS to Arbor and I've got PaperCut MD, Paxton, DHCP and DNS services left.

Our staff are using Windows clients and the plan is to replace DC server with Google Credential Provider for Windows.

For DC services I've successfully moved DHCP to our UDM firewall and this works fine.

I can't figure out how to migrate DNS service. I've migrated it once to the same UDM firewall, everything worked for few weeks, but later on Windows clients started coming up with domain error messages related to lack of DNS service hosted on DC.

[psydii]

If you still have AD you need* a Windows DNS server its usual for the AD DCs to be the DNS servers of the network. Once you no longer have AD your DNS server can be anything/where.

 

 

*or a load of non-standard config on a 3rd party DNS server

[gszech]

Thanks, I thought that's the case. Bit annoying, will move away from other services first and at the end migrate DNS / DHCP.

 

If school Windows laptops are moved to Azure Active Directory do they still need local DC / Windows DNS server ?

[PotNoodleTech]

Is managing even just one onsite server really such a big problem?

 

I literally hardly ever do anything with my servers. HyperV, Veeam, it all just does it's own thing. Other than the odd windows update on the host.

 

If i had just one Server with just DHCP on it I probably wouldn't need to touch it for 6 months at a time?!!

 

Reading through serverless schools threads sometimes feels like "jumping through many hoops to be serverless just for the sake of it"

[cwade1001]

Hi, no local AD onsite, all through Azure. So the requirement for a local DNS is removed, unless there is a need to resolve local devices on the network via name.

[gszech]

If someone is managing one school then this is not a problem.

This becomes an issue is when you work for multiple academy trust and manage multiple primary schools, here is why:

 

1. It's an extra thing to worry about as any server can fail at any point.

2. Additional costs: Server / UPS hardware, backup (plus cloud backup), antivirus and Windows server licenses.

3. A lot of extra work with fixing any vulnerabilities fund by apps like PingCastle.

4. Noise / heat issue. In most primary schools server cupboard is also a temporary office for IT staff.

 

There are also some benefits by moving to cloud.

Moving to Azure or Google Credential Provider adds two step verification to Windows devices.

For hybrid schools that use Windows and Google, user management it's easier as there is just one account to manage via Google Admin panel.

[dmj]

If you still have AD you need* a Windows DNS server its usual for the AD DCs to be the DNS servers of the network. Once you no longer have AD your DNS server can be anything/where.

 

 

*or a load of non-standard config on a 3rd party DNS server

Off topic nitpick: I think you're slightly overstating the reliance on a windows DNS server. Yes AD uses DNS, in the same way it uses CIFS/SMB shares or DHCP, but its not in any way reliant on Windows DNS. it's a fairly common situation in larger organisations who operate public DNS servers to use BIND as their AD DNS (At my last place we had 20,000 users on BIND/AD DNS). It is a standard and supported configuration.

[psydii]

Off topic nitpick: I think you're slightly overstating the reliance on a windows DNS server. Yes AD uses DNS, in the same way it uses CIFS/SMB shares or DHCP, but its not in any way reliant on Windows DNS. it's a fairly common situation in larger organisations who operate public DNS servers to use BIND as their AD DNS (At my last place we had 20,000 users on BIND/AD DNS). It is a standard and supported configuration.

Not many primary schools (or even MATs) have a 20,000 user footprint. Organisations where DNS Admin was a specific role allocated to specific people are of course likely have dedicated non-windows DNS servers. We are not operating in that context.

[mavhc]

You're trying to become serverless, but still want to run a dhcp server. This is a paradox.

 

Why do you want to be serverless, because you don't want a single point of failure and something to manage? But you already have a single router, I assume.

 

A physical server is just a computer. A router is just a computer. A switch is just a computer. An access point is just a computer. A printer is just a computer.

[dmj]

Not many primary schools (or even MATs) have a 20,000 user footprint. Organisations where DNS Admin was a specific role allocated to specific people are of course likely have dedicated non-windows DNS servers. We are not operating in that context.

 

Agreed, but I wanted to dispel the myth that it's a requirement or some sort of unsupported configuration as it's actually quite a common setup.

[gszech]

You're trying to become serverless, but still want to run a dhcp server. This is a paradox.

 

Why do you want to be serverless, because you don't want a single point of failure and something to manage? But you already have a single router, I assume.

 

A physical server is just a computer. A router is just a computer. A switch is just a computer. An access point is just a computer. A printer is just a computer.

 

I will take your advice and remove the "paradox" DHCP server from the network. You are right there is no single point of failure if there is no DHCP.

 

[mavhc]

I will take your advice and remove the "paradox" DHCP server from the network. You are right there is no single point of failure if there is no DHCP.

 

[ATTACH=CONFIG]68744[/ATTACH]

 

The point is there are already many single points of failure and systems to update, whether you call a computer a "server" and thus it must be eliminated to become "serverless" is a philosophical question, not a technical one

[gszech]

The point is there are already many single points of failure and systems to update, whether you call a computer a "server" and thus it must be eliminated to become "serverless" is a philosophical question, not a technical one

 

In our case we use the same firewall models across all primary schools. The firewall configuration is backed to the cloud on a daily basis. There is a spare firewall unit in our office in case one of the boxes dies.

As per DfE recommendation we are using two broadband lines for each school, so there are two routers in each building. Because we use the same supplier for our backup broadband lines they gave us one spare router in case one of them fails. We also keep spare PoE switches and APs if needed in the main office, it's just common sense to have them ready on standby.

 

In my opinion it's easier and faster to replace network appliance instead of recovering whole DC from a backup, but removing single point of failures is not a main reason of going serverless. As mentioned before if you manage 10+ schools going serverless means that you have less servers to worry about.

[dmj]

I think 'serverless' is getting misapplied in this thread.

In a cloud native environment 'serverless' generally means an application running in a container on a managed server - AWS this is Lambda functions, GCP it is called CloudFunctions and in Azure it is called Azure functions. I think that's the generally accepted meaning of serverless.

[cwade1001]

I think the main point is to remove the Windows "Server" box that sits in the primary school doing DHCP/DNS/AD etc. A school has moved all its data to OneDrive/Teams/Sharepoint/Google etc..... Devices managed in Google/Intune etc.... MIS is in the "cloud", printing is run via Printix or Papercut (others available). Now I am left with a fairly large fan heater (the old server doing DHCP/DNS only) and a UPS. I think it would be great to use the router, however that is out of the question as the provider does not allow management of the device and requests can be time consuming, so we have to find something to sit behind that to dish out DHCP... and the DNS is a luxury, I dont think necessarily required in a primary with maybe 100 devices and nothing on the local network requiring it.

[cwade1001]

In our case we use the same firewall models across all primary schools. The firewall configuration is backed to the cloud on a daily basis. There is a spare firewall unit in our office in case one of the boxes dies.

As per DfE recommendation we are using two broadband lines for each school, so there are two routers in each building. Because we use the same supplier for our backup broadband lines they gave us one spare router in case one of them fails. We also keep spare PoE switches and APs if needed in the main office, it's just common sense to have them ready on standby.

 

In my opinion it's easier and faster to replace network appliance instead of recovering whole DC from a backup, but removing single point of failures is not a main reason of going serverless. As mentioned before if you manage 10+ schools going serverless means that you have less servers to worry about.

Could I ask what firewall make you use to back up the configure daily? Thanks

[mavhc]

Get a random computer and install dhcp on it, or two and have redundancy, a raspberry pi would be overpowered for that task.

 

Or run dhcp centrally for your 10 schools, or run it on your firewall computer. Or run it in the cloud. Or one of your switches. Or on multiple of your switches. They're all just computers in the end

[chaplic]

Thanks, I thought that's the case. Bit annoying, will move away from other services first and at the end migrate DNS / DHCP.

 

If school Windows laptops are moved to Azure Active Directory do they still need local DC / Windows DNS server ?

 

You still need DNS server if you have ANY active directory in play - albeit Azure AD joined PC, signing in with Azure AD Accounts, will reduce the burden (and still allow you to access AD resources).

 

Assume you have azure ad connect in place and passsword hash sync, the route to getting to Azure AD only is reasonably straightforward by making the domain MS managed.

[ITJAY2023]

I briefly read the comments but practically we just went for

A router for DHCP & DNS

Netsweper for Web Filtering w/ Azure Security Groups

Azure AD to replace Active Directory

Intune for the iPads instead of a Lightspeed MDM

 

Printing is the only thing which is a downside, our solution was to manually map printers on the staff devices as there wasnt many however we still need to find a solution via script/win32 which deploys the printers out