Anyone gone from full AD domain to just DHCP and perhaps DNS (server-less)

[TwistedHelixis]

Small primary school

Moved all clients off from the AD domain, so now I am thinking about DHCP and DNS.

 

Printer is IP based, Door system is IP based.

Just wondering, do I even really need DNS internally?

 

Would be great to chat with someone that has already gone down this path.

[dhicks]

1 hour ago, TwistedHelixis said:

Just wondering, do I even really need DNS internally?

 

Much the same as you, we have an internal print server (Papercut) and door entry system (Paxton / Inventry), both of which are fine using internal IP addresses. We do have a couple more servers (remote desktop, applications), but those are accessed via a Cloudflare zero-trust tunnel using Cloudflare's (external) DNS server. The only reason we've just had to re-introduce an internal DNS server is with the switch to Smoothwall for our filtering, which needs a defined domain name (e.g. smoothwall.example.com) to be able to handle login-with-Google SSO. Smoothwall acts as its own DNS server, though, so it's not something we need to think / worry about.

[TwistedHelixis]

@dhicks

 

Quote

The only reason we've just had to re-introduce an internal DNS server is with the switch to Smoothwall for our filtering

 

We are using Smoothwall for our filtering. Not the cloud filter, which I really want, as that doesn't work, but the proxy based one.

 

I have just setup a GCPW win11 VM, and even if I use 8.8.8.8 as the DNS server on the client in the school the filtering still works.

If I don't have anything entered in the proxy, I get full pupil filtering and if I enter the staff proxy settings, I still get the staff filtering.

 

Are you trying to do something different to me?

 

 

[dhicks]

10 minutes ago, TwistedHelixis said:

Are you trying to do something different to me?

 

Yes: we have login-with-Google (OAuth) set up on our internal Smoothwall appliance, which needs a defined domain name (e.g. smoothwall.example.com) so that Google's OAuth implementation has somewhere it can see for OAuth authorisation callbacks. This means people with non-managed devices can sign in to the appliance with their school Google accounts to get appropriate filtering if they want (otherwise they just get filtered at the default, strictest level). I suspect this won't be used much, if at all, once we get the Windows client for managed devices working (which might take a few weeks for me to write) and get our WiFi system (Ubiquiti UniFi) configured to be able to hand out guest logins for visitors.

Edited December 26, 2025 by dhicks
Added a comment.

[TwistedHelixis]

2 minutes ago, dhicks said:

 

Yes: we have login-with-Google (OAuth) set up on our internal Smoothwall appliance, which needs a defined domain name (e.g. smoothwall.example.com) so that Google's OAuth implementation has somewhere it can see for OAuth authorisation callbacks. This means people with non-managed devices can sign in to the appliance with their school Google accounts to get appropriate filtering if they want. I suspect this won't be used much, if at all, once we get the Windows client for managed devices working (which might take a few weeks for me to write) and get our WiFi system (Ubiquiti UniFi) configured to be able to hand out guest logins for visitors.

 

Thanks 🙂

[FN-GM]

Many firewalls can be used for DNS & DHCP. Whatever Smoothwall solution you go for, you will still need a on-premise firewall.

[TheHyperTechie]

On 23/12/2025 at 15:04, TwistedHelixis said:

Small primary school

Moved all clients off from the AD domain, so now I am thinking about DHCP and DNS.

 

Printer is IP based, Door system is IP based.

Just wondering, do I even really need DNS internally?

 

Would be great to chat with someone that has already gone down this path.

I did exactly this, a few months into my role at my current school.

 

1. Didn't need AD anymore, all users using GCPW.

2. Didn't need a file server anymore, I migrated each on-site file share to Google Drive

3. Wanted to remove the server, so migrated our DNS and DHCP to our Juniper firewall via RM.

4. Printers were already handled through the cloud (Ricoh Cloud Print) so we didn't need a print server.

 

It was a great decision, and meant that the school didn't need to fork out for a new server, and AC for the room. Just the licenses for GCPW which was about a fifth of what it would have cost if we went down the other route.

[FN-GM]

20 hours ago, HyperTech said:

was about a fifth of what it would have cost if we went down the other route.

 

Also take into account the cost of electricity consumption and maintenance of a server.