One Domain or Two?

[Paid_Peanuts]

I am currently investigating our AD setup. Now although we run a native 2003 domain our implementation leaves somewhat to be desired.

We currently have two separate domains, one for curriculum and the other for admin.

Over time these two domains have overlapped to the point where it is becoming an absolute nightmare to support. We have staff with unrestricted access to the machines – not locked down via GPO at all.

 

I want to scrap both domains and consolidate into one domain for both admin and curriculum.

 

Has or does anyone else run just the one domain within a secondary?

[Guest kerrymoralee9280]

Yeah, we migrated to one domain about 3 years ago and I have to say it's worth the time planning/doing! It has just made life that bit easier.

[webman]

Same here. We're a single integrated CC3 domain.

[Jon]

The only reason I can see for having two domains would be if you require seperate password policys. If not then one domain should be the way to go.

[elsiegee40]

As above - passwords... We have tinies (aged 4) who require very simple passwords and you can only have 1 pasword policy in the domain.

 

To enforce a more complex policy for staff would require a second domain.

[Domino]

surely you could have a simple password policy at a domain level and make it more complex at an OU level?

 

Not that I've tried, just thought that it would be possible

[sidewinder]

^ Its not possible unfortunatly

 

I suppose it makes sense in terms of business but its quite an annoying restriction in education

[BKGarry]

Go for one domain, we did it over 2 years ago, but items like SIMS require staff to be local administrators of the machine (not domain) because of SOLUS, there is no real reason for 2 seperate domains anymore, More than likely you share the same email server, ISA/Proxy server, and even (on most counts) the same switches.

 

Just make sure you keep your old DC for the secondary domain to one side for a while, just in case you need anything off it, and i mean at least one year as you will find something needs to be used right at the last minute.

 

Gaz

[binky]

use RM Password Plus, it will work on vanilla networks.

[webman]

BKGarry: There must be a better way. None of our staff need local admin rights for SIMS.

[tarquel]

Running two physically seperated networks, and domains - one admin, one curriculum.

 

Mainly down to how the networks have been for the past 10 years.

 

The roles are starting to intermingle a bit, so maybe a trust between the networks would help there.

 

Regards

Nath

[Domino]

@webman: really? thats strange,

 

capita have always told us that was the case.

 

I know the upgrades don't run if they're not local admins, and I'm sure part of the profiles module require it too.....

[alonebfg]

I would have thought that the data protection issues and with the older kids always trying to Hack ect ect two domains is always a safer option I know some schools in my area have been told got to have two also i know swgfl does not let us use one there are two address ranges for us.

[dave-a]

At present we run two domains, one for teachers and pupils and one for admin staff. But this summer we are switching to just one domain for all staff and also dropping viglen classlink which we have been using for the last five years and going for a vanilla 2003 network.

[GrumbleDook]

A single domain here too ... we moved just on 2 years ago to make the most of Server 2003 and get everybody on board for SIMS.

 

As for security ... it is only as secure as the stupidest user ... but that is the same with any system and we just try to take the most reasonable measures we can.

[DSapseid]

We switched from one CC3 network and one vanila (with no gpo's!!) to one single network with 4 new servers just over a year ago and it was the best thing we ever did!!! It makes our lives so much easier.

 

@alonebfg- we have got 2 address ranges as well but when we migrated networks we bought an ISA server that only gives out one address to our LEA network and use 192.168 internally now and again this works well. Although i am having to set up a few machines with bypass' on the ISA server as we have got a new filtering system and it requires a specific address to unblock certain machines from more websites.

[t_guest]

same with us two domains 1 for pupils and 1 for staff

[Oops_my_bad]

Just going through the process of migrating to one domain and getting rid of VLANS altogether It makes sense because everyone uses the same email, file, proxy and print servers (plus I am being paid to manage 1 network and not 2) 8)

 

We are using IPsec between our SIMS server and admin PC's (for those of us extremely paranoid about security) :twisted:

 

Even though we're partway to migrating to one domain things are so much easier to manage. I would deffo recommend doing it if you can and there is a strong case for it.

[Trav]

We have 2 seperate domains here as county advise this, because of the nature of SIMS and its data.

When SIMS is on a domain you are restricted to what else you can run with it according to county, we are ok apparently with Office and a couple of other bits but thats about it.

 

It makes life easier here to maintain 2 networks and I fail to see whats difficult with it. It also keeps the SIMS data completely away from pupils etc.

 

Hope that helps.

[ChrisP]

3 domain here

[DSapseid]

3 domain here

3?? Admin, Curic and ???????

[ChrisP]

3 domain here

3?? Admin, Curic and ???????

 

We have a project based on-site that does mentoring for our school and 2 others (Community Paediatric SLT Team & Behaviour, Education and Support Team). It hosts top-secret data or at least they seem to think it does.

[plock]

We've recently moved to a brand new site, the old site had two domains, one for curriculum and one for admin.

 

The new site holds one domain for all, with the vast developments in security, as long as it's kept tight; there is no need for a second domain in my opinion.

[ChrisP]

We've recently moved to a brand new site, the old site had two domains, one for curriculum and one for admin.

 

The new site holds one domain for all, with the vast developments in security, as long as it's kept tight; there is no need for a second domain in my opinion.

 

 

And what if someone got the domain admin password for your curriculum domain?

[plock]

Now that wouldn't be good! That's why I say "as long as it's kept tight"!

 

The 'Domain Admin' password should be kept as secure as possible, also regular changes helps.