Suggestions for a complete school IT redesign

[Blind]

Just for clarification: I am not a network guru, but being a network admin is a significant part of my daily duties. (My small private school can only afford one tech guy and apparently I had some penance to serve) My first full summer is approaching and I need to scrap and rebuild the all the poorly configured servers and workstations. I’m going to provide a rough description of my current situation and resources to solicit your ideas for best practices.

 

Current situation

1 school building (nicely networked –now that I’ve taken out all the wireless access points… WEP is not my friend)

~60 faculty and staff members

~350 students

 

~200 workstations (all static IP for some reason)

- all running XP – they range in speed from Celeron 500MHz to P4 3.2GHz

a computer in every room, 6 computer labs (no current lab management software) and a library (~15)

 

2 servers (2 separate domains, no group policy or any other kind of centrally managed security or updates)

 

1 Windows 2000 server (P4 2.8, 1GB RAM)

- serves office staff and hosts school accounting software

 

1 Windows 2003 server (dual 3GHz Xeon, 1GB RAM)

- acts as fileserver for all students and teachers, hosts school management and grade software

 

Resources

- Enough money for new systems (~35) to remove Celerons and bring the minimum system up to a P4 1.6.

- Enough money for 2 new lower end servers

- Enough money to roll out some new software (impero, scriptlogic, geneva logic’s vison are a few that I am looking into. I liked NSS, but it would eat my entire budget)

 

Potential Desires

- Reinstall and upgrade existing servers

- Implement some kind of centrally controlled security and update solution (currently looking into scriplogic)

- Separate students from teacher and grading server

- Reimage all workstation to be free of years of winrot (need new imaging solution. Ghost on a floppy is just so wrong)

- Install lab management software

 

Lesser Desires

- Deploy a print server

- Deploy network and system monitoring software (ipmanager, zenoss, etc)

- A million other things that I can’t think of right now

 

 

Let me have some ideas on how you would redesign my sad little situation. Crying in a corner does not work

 

 

(I put this in the windows forum because it seems to get the most traffic and I did not know where else it would fit. Please move it if it belongs somewhere else)

[tosca925]

Good luck

[Ric_]

Potential Desires

- Reinstall and upgrade existing servers

>> Stick approx 1GB RAM in each existing server and leave the other server as is... add the two new Xeon/Opteron servers into the mix to give you 4 servers

- Implement some kind of centrally controlled security and update solution (currently looking into scriplogic)

>> IMHO WSUS is sufficient for this with GPOs for software deployment

- Separate students from teacher and grading server

>> I personally believe that it is easier to manage everyone in the same domain... just amke sure permissions are right

- Reimage all workstation to be free of years of winrot (need new imaging solution. Ghost on a floppy is just so wrong)

>> I would suggest WDS is the way forward here... spend a week setting it up and away you go (plus you already have it so no cost ). GPOs can be used for software installation

- Install lab management software

>> Just go for it

 

Lesser Desires

- Deploy a print server

>> The upgraded P4 can be used to run Pykota

- Deploy network and system monitoring software (ipmanager, zenoss, etc)

>> Install Nagios on the above server too

- A million other things that I can’t think of right now

>> You mention that you are in a private school so they might turn their nose up at second-hand kit but if you insist on 'nice looking' kit you could stretch your budget further.

>> Look into something like Smoothwall/IPCop/Endian Firewall as a cheap way to implement a web cache/firewall/filter

>> Get your GPOs sorted!

>> You make no mention of an UPS! (May I recommend a SmartUPS RT with SNMP management card?)

>> Since you are going to be inspecting and re-imaging all your machines - take an inventory while you are at it! A barcode scanner (stolen from the library?) and a laptop can help here

>> Implement a helpdesk (Liberum or One||Zero)

>> Use Windows Server R2 to implement file quotas and file screening

 

Do you want more?

[StewartKnight]

6 Weeks holiday... hell, you have some penance to make up for, I hope you don't intend to sleep.

 

I'd suggest you pay someone to help you, by the sounds of it, you'll need someone more technical that you, if you don't mind me saying.

 

As prevoiusly mentioned, use Group Policies as much as possible, and if I were you, I'd start practicing with a VM client 1st, because you won't have a lot of spare time to start problem solving once the hols are underway.

 

Also, "The Wrong Side Of The Pond" is a bit vague, I'd recommend you give us a better indication of your whereabouts in case anyone nearby can offer practical assistance!

[tosca925]

where abouts are you blind?

[Bestbett]

Let me give some suggestions:

 

Ensure you have control over the PCs bios. Ensure cd boot, floppy boot, and USB boot are all disabled. Set an admin password and make sure its secured so they cant set a hd boot pw. (only 2 boot options my pcs have are NIC (RIS) and HD. If you have a homogeneous provider then get a bios control solution in place.

 

I would have a OSx server (OS-wise, could be on a g5 tower) in place for student shares and DHCP. Mac comes with a handy built in feature with its DHCP called DHCP filtering that allows you to list all your Mac addresses and only allow those pcs to get addresses. (doesn't prevent mac spoofing but neither does port security alone, and this is much easier to set up.) Also, OS x uses samba which has veto files and ABE built right in.

 

I would also recommend Sophos' firewall solution as it has eliminated many headaches for me. It acts as a reverse hash firewall where I have to specifically allow any hash of any program that trys to use the net. ( I love this program!)

[plexer]

Why would you recommend an OSx server when he has all windows xp clients and allready has windows servers.

 

I would recycle your existing low end server into a print server either windows 2003 or a linux pykita solution and add some more ram to it.

 

I'd add atleast another gb of ram into your xeon and then instead of buying 2 low end servers buy one more xeon well specced one.

 

Your 2 xeon servers would then be configured as dc's with dhcp on one and dns on both of them.

 

GPO's for lockdown and software deployment.

 

Ben

[Blind]

For those wondering, I'm in the United States. (you know, the place where you have to use bit torrent to get new Doctor Who episodes)

 

Our summer break is almost 3 months long and so I have a bit more than 6 weeks to blow this thing up.

 

Thanks for the ideas. It's always great to hear the opinions of others.

[StewartKnight]

Where in the States? I'm sure if you offered free board and lodgings......!!

[localzuk]

For those wondering, I'm in the United States. (you know, the place where you have to use bit torrent to get new Doctor Who episodes)

 

I thought the news series' were running on the Sci Fi Channel over there?

[Blind]

For those wondering, I'm in the United States. (you know, the place where you have to use bit torrent to get new Doctor Who episodes)

 

I thought the news series' were running on the Sci Fi Channel over there?

 

They do, but not until months later and they chop bits out for commercials.

 

Politics-- I don't get the whole Bush thing either. Fortunately, we have term limits and our President can only serve for 8 years. It was funny back in the 90's because I remember news shows talking about how Blair was the British version of Clinton.

 

 

Anyway... back to IT

[djm968]

Have you thought abouth thin clients to replace some of the labs PC's?

[Ric_]

Topic trimmed to remove off topic posts - Ric_

[StewartKnight]

That harsh Ric_, how many other topics would have to be trimmed for going a little off topic??!!??

[SpuffMonkey]

For those wondering, I'm in the United States. (you know, the place where you have to use bit torrent to get new Doctor Who episodes)

 

Hope you download the "WhoFan" DVDs - they are awesome - better than the official BBC releases!

[netadmin]

I had faced a similar situation at my school when I first started (in the US, like you). Although we are a very small school (only 50pcs now), the network was a huge mess at the beginning, with no computer faster than 1GHz, most 500MHz and all machines were running 98 with no type of real networking. Anyway...

 

My recommendations:

*Combine all systems into one domain. Once everything is setup (and tested ) students will not be able to access or see anything they should not be able to or damage network settings too much.

 

*Reimage all systems. You might want to check out Ghost for Linux (it should work fine with Windows systems).

 

*I'd recommend one server to be the domain server, the other to be a file server (and allocate each user a network drive, plus a share drive for staff). The accounting software could safely run on the file server. The dual Xeon server would make a nice domain server. I don't think you really need any more servers right now. The ones you have should be powerful enough for the moment.

 

*Backup data from both servers and reinstall Windows.

 

*Install Windows 2003 server on the 2000 server.

 

*Use GPOs to lock down almost all settings from students and staff.

 

*Make sure you have decent antivirus software. Trend SMB works wonderfully for us.

 

*Setup remote desktop on the Windows 2003 server(s). Then, you can access from home, if needed.

 

Good luck with this project.

[Ric_]

That harsh Ric_, how many other topics would have to be trimmed for going a little off topic??!!??

The trimmed bits were VERY off topic and it was getting ridiculous. You'll notice that the important sci-fi bits are still here

 

I know that I should trim some of the other topics but I'm lazy!

[Busybub]

I would make sure that you have 2 Domain Controllers running. If you only have one and it falls over, everybody is going to be twiddling thumbs...

 

What are you doing about backups?

 

If I were starting from scratch I would dump every tape device and go with removable hard drives, preferably encrypted ones you can take offsite.