karlr Posted February 5, 2014 Posted February 5, 2014 We are going to be installing a brand new Active Directory environment. This will be based on Windows Server 2012 R2 domain controllers (all virtualized under ESXi/vSphere), and hopefully all clients will be Windows 7+. We will still have all of the data from staff/student home drives, along with things in shared areas, but these will need to be copied and sorted out on a new file server. What I'm interested in is how others currently have their AD set up - and, if they were able to recreate it from scratch, what they might do differently. This includes everything from how domain controllers are configured, through to OU structure, groups, NTFS permissions, Group Policy, etc.
SYNACK Posted February 5, 2014 Posted February 5, 2014 (edited) Domain.internal not .local and not someotherschool.school.nz <- having to deal with the last one again thanks to a support company. School ou -users --students --staff -computers Etc. Actual install is easy, just add the roll and follow the wizard. Edited February 5, 2014 by SYNACK
featured_spectre Posted February 5, 2014 Posted February 5, 2014 @SYNACK hit the nail on the head there. It is as simple as going through the wizard. Just never add an external domain ending (.com or .co.uk etc)
localzuk Posted February 5, 2014 Posted February 5, 2014 (edited) The recommended domain naming convention is to use a subdomain of a real 'routable' domain. Eg. If you have "myschool.county.sch.uk" you would go for something like "int.myschool.county.sch.uk". The reason being is that DNS management should be easier, as you can have a single DNS server at the top level 'myschool.county.sch.uk' which controls all DNS for your site, internal and external. Using the *same* domain internal and external is not advised, as you can end up with 1 name being needed for 2 different things, meaning you suddenly have a DNS issue. Edited February 5, 2014 by localzuk
seawolf Posted February 5, 2014 Posted February 5, 2014 @SYNACK hit the nail on the head there. It is as simple as going through the wizard. Just never add an external domain ending (.com or .co.uk etc) I agree with the never using a .local domain, that was a cruel joke MS consultants played on the world. Also the basic structure SYNACK stated is also a good start. However, I disagree with the advice about not using a valid domain name - what is the reason for that? It's actually considered best practice, and I have never encountered a single problem with it. You do need to either register a domain name that will never be used publicly for the internal domain or use a subdomain of a public domain and use split DNS (views) to properly segregate public from private. I could only see a problem if something were misconfigured quite badly.
featured_spectre Posted February 5, 2014 Posted February 5, 2014 The problem I have encountered is when I inherited a badly configured one and had to redo it from scratch. Was not happy to say the least
SYNACK Posted February 5, 2014 Posted February 5, 2014 (edited) The recommended domain naming convention is to use a subdomain of a real 'routable' domain. Eg. If you have "myschool.county.sch.uk" you would go for something like "int.myschool.county.sch.uk". Which is perfectly fine as long as no one decides to put a * record on the domain and suddenly all your clients Spend a quality 25 seconds crying when outside the network and trying to connect to the domain or use nla which gets very concerned. It also relies on your school keeping the domain forever which is also not a given. Edit, of course given the new domain rules some tool will register .internal shortly anyway and break that too. Edited February 5, 2014 by SYNACK
localzuk Posted February 5, 2014 Posted February 5, 2014 Anyone who puts a *. record on a DNS server for a production domain needs shooting. That isn't a network design problem, that's a ID10T problem. I'm just going by the advice Microsoft give for domain naming.
SYNACK Posted February 5, 2014 Posted February 5, 2014 Anyone who puts a *. record on a DNS server for a production domain needs shooting. That isn't a network design problem, that's a ID10T problem. I'm just going by the advice Microsoft give for domain naming. Agreed, just pointing out the possible holes that I have had to fix up.
karlr Posted February 5, 2014 Author Posted February 5, 2014 Using a sub-domain of a publicly registered domain name does seem to be the recommended option these days. Local domains based on "fake" TLDs aren't guaranteed to be unique (though in theory they shouldn't need to be). Another more serious problem is that major CAs these days will only sign certificates based on real domains that you own. Again, maybe not the end of the world since you can push your own root certificate out to domain managed clients. Any thoughts on the number of domain controllers and FSMO role setup? I'm currently planning on having three DCs - the first will take on the forest roles (Schema Master, Domain Naming Master), the second will have the domain roles (PDC Emulator, RID Master), and the third will house the unused Infrastructure Master role but be available to transfer/seize other roles if there is a problem with one of the other DCs. All three would run DNS + Global Catalog. Currently playing around with DHCP too. We do currently have two DHCP servers, but I have no idea if they are properly load balanced or anything. 2012 & R2 support proper load-balanced DHCP servers and will even let you sync reservations and exclusion ranges with one click too, so probably going to go with DHCP running on the first two DCs if there's no downside to that.
localzuk Posted February 5, 2014 Posted February 5, 2014 Only need 2 really, for redundancy. In schools there simply isn't the need for such separation of individual roles. With 650 devices at my last school, a dual Xeon server, 4 years old 2 years ago, had a CPU usage of about 3% at peak.
Mustang Posted February 5, 2014 Posted February 5, 2014 The recommended domain naming convention is to use a subdomain of a real 'routable' domain. Eg. If you have "myschool.county.sch.uk" you would go for something like "int.myschool.county.sch.uk". The reason being is that DNS management should be easier, as you can have a single DNS server at the top level 'myschool.county.sch.uk' which controls all DNS for your site, internal and external. Using the *same* domain internal and external is not advised, as you can end up with 1 name being needed for 2 different things, meaning you suddenly have a DNS issue. I agree with this and i have yet to see anything else that says this isn't best practice. This set is also more friendly when throwing osx into the mix.
Mustang Posted February 5, 2014 Posted February 5, 2014 Any thoughts on the number of domain controllers and FSMO role setup? I'm currently planning on having three DCs - the first will take on the forest roles (Schema Master, Domain Naming Master), the second will have the domain roles (PDC Emulator, RID Master), and the third will house the unused Infrastructure Master role but be available to transfer/seize other roles if there is a problem with one of the other DCs. All three would run DNS + Global Catalog. I remember reading somewhere that you need a minimum of 3 DC to provide redundancy for the FSMO roles.
psydii Posted February 5, 2014 Posted February 5, 2014 The recommended domain naming convention is to use a subdomain of a real 'routable' domain. Eg. If you have "myschool.county.sch.uk" you would go for something like "int.myschool.county.sch.uk". . Got a reference for that? I remember reading it years back, but changed after my first network to .internal for what I remember to be good reasons....
localzuk Posted February 5, 2014 Posted February 5, 2014 Link http://social.technet.microsoft.com/wiki/contents/articles/17974.active-directory-domain-naming-considerations.aspx
computer_expert Posted February 5, 2014 Posted February 5, 2014 If you are going to be using Macs then it is also worth bearing in mind that .local domains cause a few issues too.
burgemaster Posted February 5, 2014 Posted February 5, 2014 With our rebuild we did the following which we found helped us.... 1) We tried to create individual policies for different settings. Only the Student and Staff Default policies have multiple settings .. 2) Label each GP clearly. All computer policies begin with © computer, (U) user or (L) for loopback. Then the general area and then description of the GP, e.g.... "© - SW INSTALL - Install Flash player" If they call a script add (Script) on the end. 3) Not sure if this helps with performance but disable the USER section on all COMPUTER policies and vice versa. Goodluck 2
psydii Posted February 5, 2014 Posted February 5, 2014 @localzuk thanks. While looking for an answer to my own question I found the successor to the information I read when first doing this... http://go.microsoft.com/fwlink/?LinkId=157704 and the grand daddy of AD design documents: Best Practice Active Directory Design for Managing Windows Networks 1
MatthewL Posted February 5, 2014 Posted February 5, 2014 I've got a document I will share from the new build of one I did last year if I can find an electronic copy of it.
seawolf Posted February 6, 2014 Posted February 6, 2014 If you are going to be using Macs then it is also worth bearing in mind that .local domains cause a few issues too. Cause a "few" problems - that's an understatement! I would rather have my fingernails pulled out one by one than try to use Macs on a .local network. It can also cause problems for other systems as well.
MordyT Posted February 6, 2014 Posted February 6, 2014 Cause a "few" problems - that's an understatement! I would rather have my fingernails pulled out one by one than try to use Macs on a .local network. It can also cause problems for other systems as well. We have a Mac... On a .local domain. No issues with it 99% of time.
seawolf Posted February 6, 2014 Posted February 6, 2014 We have a Mac... On a .local domain. No issues with it 99% of time. One Mac is one thing - 300+ on a .local network is another all together.
MordyT Posted February 6, 2014 Posted February 6, 2014 One Mac is one thing - 300+ on a .local network is another all together. Can you explain/expound on said issues. It's info I would need to know if more people get a Mac... That being said, the Mac user has had such a miserable time with the Mac and lack of our support I think we scared everyone back into windows. (Old captive portal used old java which apple blocked... He had no internet access for months... Fortunately for him we were in middle of replacing the whole system anyways and now it does SSO if a domain user)
seawolf Posted February 6, 2014 Posted February 6, 2014 Can you explain/expound on said issues. It's info I would need to know if more people get a Mac... I'm not surprised your sole user has had issues. Here are some things you are likely to come across at one time or another: 1. Inability to bind to AD domain or losing the AD domain bind. This seems occur periodically with various releases on both the Mac and Windows server side 2. VERY, VERY, VERY slow network account logins, sometimes exceeding 5 minutes on the LAN, and taking over 20 minutes for logging onto mobile (network) accounts off the LAN due to the number of timeouts that occur. 3. VERY slow mounting of network drives, slow copying to said drives. 4. VERY slow printing to network printers 5. Major bonjour issues, including for AirPrint and AirPlay on iOS devices. Some links with discussions about these sort of issues commonly faced in .local domains. As I said, .local domains were a cruel joke played on the world by being in Microsoft's "Best Practice" documentation that was then espoused by MS technicians the world over. https://discussions.apple.com/message/15834652#15834652 OS X 10.7, Lion, and ".local" domains | Thursby Software http://www.centrify.com/downloads/public/centrify-directcontrol-for-mac-local-domain-workaround.pdf Dmitry Dulepov: OS X Lion and local DNS issues active directory - Painfully slow login to AD bound Mac OS X Leopard machine when off home network - Server Fault https://jamfnation.jamfsoftware.com/discussion.html?id=8872 https://jamfnation.jamfsoftware.com/discussion.html?id=6581 https://discussions.apple.com/thread/2143988?start=105&tstart=0 https://discussions.apple.com/message/12346886#12346886 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now