Hyper-V Hosts

[Jawloms]

Morning,

 

Do you have your Hyper-V hosts as standalone devices, or in their own domain? Obviously their own domain means setting up another domain just for them, but it does enable live migrations. I appreciate we're not constantly moving servers from host to host, but it is handy at times!

 

Stuart

[stevewill6]

Both my hosts on the school domain.

 

We do have off site DC (LEA hosted) and a DC on the one of the hosts

Edited September 6, 2023 by stevewill6

[Jawloms]

Both my hosts on the school domain.

 

This is not the recommended, and anyone who has been hit by a ransomware attack will tell you why.........

[Aprice]

For sites with clusters, own domain ALWAYS!!!!

 

Please don't be tempted to add them to the 'Production' domain, when something goes wrong you've multiplied your problems.

 

If it's a single host then just standalone, no domain and firewall enabled.

[stevewill6]

From my experience and reading best practice is for hosts to be on the domain. Microsoft also recommends domain joined.

[Jawloms]

Yep, they do. You speak to any security people and the recommendation is absolutely not to though. If you get hit by something, you'll believe MS are wrong in this advice as well.

 

If there weren't bad people in the world then 100% domain join your hosts.

[jthompson]

This is why I'm not in love with failover clusters: I always feel as though the benefits of them are massively outweighed by the complexity, and that there's always a single point of failure anyway.

 

We've supplemented ours with a DC on a standalone Hyper-V host.

Edited September 7, 2023 by jthompson

[Jcx500]

Separate Forest if you have more than one host. Name it like SCH-HVDomain.

 

Also the same with Vcentre , no ties to Production AD. Separate Creds and on mgmt vlan

[ColonelPanic]

We have 3 hosts that live on their own domain, a DC on each in HV (a .internal domain)

The production servers then live in Failover Cluster Manager on their own domain.

 

We could lose 2/3 hosts and still get by. Hugely overkill for a school though

[JRA]

Just reviving this as looking myself at moving to Hyper V. Seen both approaches before now (domain-joined hosts and joined-to-separate-internal-domain-running-the-virtual-dcs approach.) Not decided which way I'm going here, tempted for it to be the latter if I have to decide though. Will be two hosts I'd think.

 

Can you get replication and migration working though if both hosts are just standalone? As in, just workgroup only?

Edited September 27, 2024 by JRA

[jthompson]

This page seems to suggest that the nodes will need to be members of the same AD domain - https://learn.microsoft.com/en-us/windows-server/failover-clustering/create-failover-cluster#verify-the-prerequisites

Make sure that all servers that you want to add as cluster nodes are joined to the same Active Directory domain.

 

Also, cluster-aware updating (CAU) requires that the nodes are joined to the same AD domain.

[JRA]

Thanks for that. Wonder if there's any merit in non-cluster, just letting them replicate every 5 mins if I can, then seeing what I can leverage Veeam to do. Will have a read on that, not sure if Veeam can do migration even. Although if so it's nearing the same amount of setup then as the dedicate mini-domain approach.