New School, New Network

[mattianuk]

Hi all,

 

Long time lurker, first time poster!

 

I recently got a Network manager gig, after 7 years as a technician.

 

I know how networks 'work' and I have been able to understand why we have done what we have done etc.

 

I am now faced with an alien network. Im not sure if it is just me - but the way it is set up does not reflect what I have done before, it does not seem to lock down Windows at all. RDC/CMD are available to all. Im not sure how profiles are set up, and it seems to be running very slowly.

 

I have been given a large pot of money. Enough (more then!) to build the school a better network. I need to replace PCs around rooms to the tune of 50 odd, an IT room of 36 as well. As that is pretty much the large majority of machines (exc laptops which Im leaving for the moment) I thought about getting some new servers and starting from scratch. Reading some other threads, people generally say if you can do it - its the best option.

 

So this is my plan:

 

Server 2008 R2 servers running hyper V - hosting a couple of DCs (on different hosts) exchange, SIMs and a print server

1 file storage server

 

Windows 7 SP1 clients throughout the school with office 2010 and have WSUS inplace to do windows update.

 

I want to use just GP to lock things down (trial and error I think?) and use GP to send out software. We do have impero, which is a nice bit of kit for wider management.

 

Does that sound like a plan? Any thoughts on specs for the servers?

 

Also - Im thinking of rolling out mandatory profiles across the school and using folder redirection to link back to a standard staff/student start menu/desktop.

 

Can someone explain if this is the right way to do it? And if so what do I lose by not having roaming profiles?

 

Thanks in advance!

[Achandler]

You don't actually mention what you already have.

 

What are the servers running, what are the clients running etc. No point starting fresh if you are for example already on Windows 7 clients and Server 2008 (as logn as it is 64bit) or R2 unless there is an obvious problem that exists.

 

Don't chaneg things to fast you will upset everyone, basically take between now and half term to work out what you have and how it is working, then form a plan for the summer and take it to your line manager.

[CyberNerd]

 

Don't chaneg things to fast you will upset everyone, basically take between now and half term to work out what you have and how it is working, then form a plan for the summer and take it to your line manager.

 

very good advice here. Take it slow.

When I started doing school ITSupport I was convinced that everything should be locked down as tight as possible on the clients. After several years my attitude to this has relaxed considerably - it is much more important to have the network (switches/firewall etc) and the servers secure. Security through GPO on the clients is important, but don't go ovekkill on it because it can introduce a lot of problems an annoy users. GPO to install software is worth concentrating on, as is mandatory profiles - try and keep things consistent.

[mattianuk]

We have a mixed XP/Win7 (one room, some laptops) environment here. 4 servers, 2 2003 (one that appears to do everything including file storage) + 2 DCs (2003) which are about 8 years old. There is a nice new 2008R2 brought in by the guy before me, but he did'nt stay long enough to crack on.

 

The school is ready for change - the SMT/HoD brought me in under a new headteacher with the knowledge that things were going to happen quickly and that they were funding the changes because they want it to happen, as long as I justify what I am doing in an educational context they are happy, and as I say - I am not new to this, I have been senior tech at last 2 high schools since before there were network managers... and in comparison this network is tiny...

 

These plans are for the summer btw, Im having 3 weeks of paternity at June ht, so need to get started now

[mattianuk]

very good advice here. Take it slow.

When I started doing school ITSupport I was convinced that everything should be locked down as tight as possible on the clients. After several years my attitude to this has relaxed considerably - it is much more important to have the network (switches/firewall etc) and the servers secure. Security through GPO on the clients is important, but don't go ovekkill on it because it can introduce a lot of problems an annoy users. GPO to install software is worth concentrating on, as is mandatory profiles - try and keep things consistent.

 

Any advice on mandatory profiles?

 

Not going on full lock down, but staff and students can currently access local drives, browse network shares of user files, run CMD connect to servers via RDC and that is just for starters!!!

[maark]

Would look at getting rid of xp clients to make things easier to manage by having all on windows 7.

If you have microsoft schools agreement that gives cheap licences - setup 2008R2 data center edition on your decent/new servers - this will allow you unlimited hyper v virtual servers - pretty straightforward to setup.

Setup new virtual DCs on 2008 R2 - when they have replicated ok then you can move roles off your old DCs and retire them.

Basically aim for 2008 R2 on servers - win 7 on clients and take it from there.

Impero is useful for installing software/updates that don't have msi's by logging on to several machines at once and running mimic scripts.

Also you get can rid of profiles altogether for students - will just setup a local profile when they logon first time to a machine - redirect desktop, start menu etc.

Edited April 20, 2012 by maark

[sonofsanta]

Sounds more or less like a good plan.

 

Things to consider:

* Switching - have you got a redundant core or is your core switch a SPOF?

* Virtualization - best to keep one DC physical - doesn't need much in the way of spec, so can probably re-use an old server once it's decommissioned, but you can have problems with failover clusters without a DC up - and if all your DCs are virtual, you get into a bit of a chicken-and-egg situation. It can be gotten around, but easier to avoid it altogether - plus you don't want all your eggs in one basket. Bit heavy on the egg-metaphors, this advice, but I'm just trying to lay some groundwork advice down

* Consider setting up two new admin accounts when you start - one so you're not using "administrator" as a log in (and oyu can rename guest to administrator to use it as a honey trap) and another one to give to programs wanting admin privileges to run services etc. Give this last one a long KeePass generated string of garbage. Having it separate from the domain admin account oyu use frees you up to change your domain admin password more easily.

* Look at Microsoft EES if you haven't already, could be well worth it depending on circumstances

* Also look at Live@edu for your email

* Consider System Center stuff for software deployment etc. - quite indepth but also cheap for schools

* And hell yes stop them installing software and using command - cannot believe that is still open.

 

Most of all, write down what you're doing as you're doing it, for your own benefit - if you're doing a big job like this you will soon lose track of everything you've done even a fortnight before!

 

Good luck, and enjoy

[mattianuk]

Would look at getting rid of xp clients to make things easier to manage by having all on windows 7.

If you have microsoft schools agreement that gives cheap licences - setup 2008R2 data center edition on your decent/new servers - this will allow you unlimited hyper v virtual servers - pretty straightforward to setup.

Setup new virtual DCs on 2008 R2 - when they have replicated ok then you can move roles off your old DCs and retire them.

Basically aim for 2008 R2 on servers - win 7 on clients and take it from there.

Impero is useful for installing software/updates that don't have msi's by logging on to several machines at once and running mimic scripts.

Also you get can rid of profiles altogether for students - will just setup a local profile when they logon first time to a machine - redirect desktop, start menu etc.

 

Yes, as Ill be replacing 40% of PCs, 10% are laptops, and the remaining are windows 7 already so will be going to Win 7 SP1 under the EES licensing.

 

I was thinking about starting a new domain. As Im going to be rebuilding all bar 30 machines anyways, this means I can crack on with testing when I get new servers in, and means I cant mess up the current domain??

 

Only problem I forsee is exisiting users with laptops. These wont be in over the summer, and Im loathed to require them to be in just to join them to new domain, any thoughts anyone? Also what is the best way laptops can be set up at the moment? Don't want to go down the sync route, I want their storage to be local only, but still want GP restrictions to secure them...

[mattianuk]

Sounds more or less like a good plan.

 

Things to consider:

* Switching - have you got a redundant core or is your core switch a SPOF?

* Virtualization - best to keep one DC physical - doesn't need much in the way of spec, so can probably re-use an old server once it's decommissioned, but you can have problems with failover clusters without a DC up - and if all your DCs are virtual, you get into a bit of a chicken-and-egg situation. It can be gotten around, but easier to avoid it altogether - plus you don't want all your eggs in one basket. Bit heavy on the egg-metaphors, this advice, but I'm just trying to lay some groundwork advice down

* Consider setting up two new admin accounts when you start - one so you're not using "administrator" as a log in (and oyu can rename guest to administrator to use it as a honey trap) and another one to give to programs wanting admin privileges to run services etc. Give this last one a long KeePass generated string of garbage. Having it separate from the domain admin account oyu use frees you up to change your domain admin password more easily.

* Look at Microsoft EES if you haven't already, could be well worth it depending on circumstances

* Also look at Live@edu for your email

* Consider System Center stuff for software deployment etc. - quite indepth but also cheap for schools

* And hell yes stop them installing software and using command - cannot believe that is still open.

 

Most of all, write down what you're doing as you're doing it, for your own benefit - if you're doing a big job like this you will soon lose track of everything you've done even a fortnight before!

 

Good luck, and enjoy

 

Ive heard of live@edu - but Im a fan of Exchange, do you use it? What has it got over exchange?

Admin accounts - good idea thanks

Got EES in pipeline

Will keep one of the servers as a DC - thanks for that

[sonofsanta]

Ive heard of live@edu - but Im a fan of Exchange, do you use it? What has it got over exchange?

Admin accounts - good idea thanks

Got EES in pipeline

Will keep one of the servers as a DC - thanks for that

 

I still use Exchange here - it was set up already so was easier to keep that running - but there's a good few folks round here use it. I think the chief advantage is Free and Not Your Problem Anymore - which wrt Exchange, can be quite the advantage!

[maark]

What email do you use now?

Exchange is good but can be a pain to setup - i would look at google apps for mail - syncs with active directory better than live@edu and you won't have to worry about backups.

[mattianuk]

Ive set up exchange in last 2 schools, this one uses the LA's software which is basically squirrel mail or IMAP.

 

Still think Im going to go for exchange 2010 tbh but will look at google apps. I just like to be in control of our core services.

[cpjitservices]

Watch it with Exchange... Exchange 2010 can be a monster!

[teejay]

Live@edu is being replaced by Office365 for edu and I understand should be available by the time you're looking at transferring. That has much better sync with ad and some other nice bits. I have to agree about Exchange 2010, it's a monster and can be a complete pita, much preferred our old Exchange 2003.

[russdev]

If in support you get unlimited remote technical and teacher training. So let us know we can remote session and get you up to speed on Impero side of things..

 

Russell

 

Hi all,

 

Long time lurker, first time poster!

 

I recently got a Network manager gig, after 7 years as a technician.

 

I know how networks 'work' and I have been able to understand why we have done what we have done etc.

 

I am now faced with an alien network. Im not sure if it is just me - but the way it is set up does not reflect what I have done before, it does not seem to lock down Windows at all. RDC/CMD are available to all. Im not sure how profiles are set up, and it seems to be running very slowly.

 

I have been given a large pot of money. Enough (more then!) to build the school a better network. I need to replace PCs around rooms to the tune of 50 odd, an IT room of 36 as well. As that is pretty much the large majority of machines (exc laptops which Im leaving for the moment) I thought about getting some new servers and starting from scratch. Reading some other threads, people generally say if you can do it - its the best option.

 

So this is my plan:

 

Server 2008 R2 servers running hyper V - hosting a couple of DCs (on different hosts) exchange, SIMs and a print server

1 file storage server

 

Windows 7 SP1 clients throughout the school with office 2010 and have WSUS inplace to do windows update.

 

I want to use just GP to lock things down (trial and error I think?) and use GP to send out software. We do have impero, which is a nice bit of kit for wider management.

 

Does that sound like a plan? Any thoughts on specs for the servers?

 

Also - Im thinking of rolling out mandatory profiles across the school and using folder redirection to link back to a standard staff/student start menu/desktop.

 

Can someone explain if this is the right way to do it? And if so what do I lose by not having roaming profiles?

 

Thanks in advance!

[nicholab]

Do consider VDI using thin client.

I would use FAT VDI in CAD and art.

 

Also I would have Core that is fiber only and top of cab switches in the server racks it will make wiring easier.

 

In the coms racks go interleaved this does not look as nices as some techniques but it pay dividends down the line.

 

24 port Patch panel

0.25, 0.30 or 0.5 patch cables

48 port switch

0.25, 0.30 or 0.5 patch cables

24 port Patch panel

24 port Patch panel

0.25, 0.30 or 0.5 patch cables

48 port switch

0.25, 0.30 or 0.5 patch cables

24 port Patch panel

 

You may end up missing switch in this design but leaving space for then at a latter date.

Edited April 20, 2012 by nicholab

[LpNova_techi]

Great provisional plan, I would do something simular. My only advise is dont set it in stone, makesure you have the flexibility to change what works for you. and I would definatly drop XP and opt for win 7. Also make sure you use a knowledgeble company to buy off as they can be the pinacle of good support.

[zag]

I'd love a challenge like this

 

- Upgrade the DC's to 2008 R2

- Create 2 file servers for redundancy. Consider DFS

- Run all other servers on Hyper-V

- Migrate to live@edu (seriously no one is installing bloated local exchange servers any more. Its pointless and yesterdays technology)

- Use SSD drives in the clients to increase real world speed for users

- Ditch profiles

[mattianuk]

Do consider VDI using thin client.

I would use FAT VDI in CAD and art.

 

Also I would have Core that is fiber only and top of cab switches in the server racks it will make wiring easier.

 

In the coms racks go interleaved this does not look as nices as some techniques but it pay dividends down the line.

 

24 port Patch panel

0.25, 0.30 or 0.5 patch cables

48 port switch

0.25, 0.30 or 0.5 patch cables

24 port Patch panel

24 port Patch panel

0.25, 0.30 or 0.5 patch cables

48 port switch

0.25, 0.30 or 0.5 patch cables

24 port Patch panel

 

You may end up missing switch in this design but leaving space for then at a latter date.

 

Thanks. Network infrastructure (switches etc) is already all in place

[mattianuk]

I'd love a challenge like this

 

- Upgrade the DC's to 2008 R2

- Create 2 file servers for redundancy. Consider DFS

- Run all other servers on Hyper-V

- Migrate to live@edu (seriously no one is installing bloated local exchange servers any more. Its pointless and yesterdays technology)

- Use SSD drives in the clients to increase real world speed for users

- Ditch profiles

 

SSD in the clients, now there is a thought.

 

TBH Im loving it. Im sure you will all live it through me as I ask for more and more advice!!!

[mattianuk]

Right, first job sorted. Got me a new Ultrabook from Novatech. Bonus. Bad side is, no OS and forgot to order a External CD ROM Drive....!!

[zag]

SSD in the clients, now there is a thought.

 

Its the biggest improvement we made in our school. Surprising really as it was so easy to do with a massive benefit to the end user.

 

To be honest they wont really care about virtualized servers or updated domain controllers so much

[gshaw]

Whatever you do... document!

 

The best thing I've ever done was set up our IT Sharepoint site; everything I do is logged on there... user requests, change management, knowledgebase, backup schedule and so on. That way when you come back in 6-12 months wondering just how you set up that awkward bit of software or what you did to the core switch config you'll have it all there for easy reference

 

Btw virtualise, EES licensing, SCCM for deployment \ management and have a look at VDI (although I still don't feel it's hit that maturity \ value for money sweet spot yet)

[nicholab]

I think that Citrix's VDI in a box is trying to get there. But for management thin client a much better in the abused and the room with IT round the (edges I stupid idea unless you have big rooms!) Also with the idea that schools now have extended opening it is difficult to get time in the rooms.

[Roberto]

Any advice on mandatory profiles?

 

Not going on full lock down, but staff and students can currently access local drives, browse network shares of user files, run CMD connect to servers via RDC and that is just for starters!!!

 

There's a difference between "Not locked down" and "users can see it" and its not clear from your post which one of these issues you're having. I can see why you may prefer to hide some things to stop users playing with them, but if permissions are correct then the fact that things are visible isn't a security risk, and if permissions are not correct then hiding something won't stop a determined user from being able to do bad things with it.

 

Accessing local drives is fine, providing that permissions are set correctly to prevent them viewing altering parts of the workstation that they should not have

access to.

 

Browsing network shares - again likewise, browsing shares isn't a problem per se (though I agree it may be undesirable). What matters is what they have permission to do; permissions need to be set on "staff only" shares to keep students out, or on "SMT only" shares to keep students and 'normal staff' out.

 

The command prompt - again simply having it is not a problem as they shouldn't be able to run commands that are harmful to the system if permissions are set correctly.

 

As for RDC - If you're saying that any user can actually LOG IN to any server via remote desktop then this is indeed a problem, because that means that someone's been playing with the default permissions on those servers. Simply being able to run the remote desktop client and connect to a server and be asked for a login isn't a problem, by default anyway, as non-admin users do not have permission to log into servers*

 

(*except terminal servers, because of course the point of these is that users can log into them...)

 

I'd suggest you need to determine exactly what users can do (not see) and then fix any permission issues you find because these are fundamental to securing your network. with that done, you can then worry about anything you wish to hide because you don't want users to see it... a completely different and separate issue to securing items.

Edited April 23, 2012 by Roberto