seawolf

Only ditch the tape if you are using cloud-based off-site secondary backups (most can't afford the pipe to make that feasible) or you use a disk-based storage solution that allows you to rotate the backup media and take the disks off-site.

I only have a few comments, but overall this looks pretty good. 1. I would never use RAID5 except for backup storage as I find is too unreliable for primary storage. You didn't specify whether you planned to use a hot spare or not. If you do plan to, don't. Besides my own experience (and others I know) with RAID5, technical reasons for not using it: http://www.smbitjournal.com/2012/07/hot-spare-or-a-hot-mess/ http://miracleas.com/BAARF/RAID5_versus_RAID10.txt So, what to use instead? RAID10 ideally, but if not in your budget at least use RAID6, it only costs you one more drive. 2. Of the other specs I might bump up if the money were there, it would be the CPUs and NICs. NICs - how many total NICs will you have? You should aim for 6-8 per server ideally. If I had to choose between more CPU grunt and more 1Gb NICs in a virtualisation solution, I would spend the money on the extra NICs. CPUs - I would go for E-2650s for the extra two cores (if I could afford them), which can become important in virtualisation. If budget doesn't allow, the 2620s will certainly suffice unless you experience a lot of growth. As for the roles of the VM servers, your plan looks good. I do question the need for the AV management server and AV update servers to be on their own separate servers. We combine those here. Also, I think it would be OK to run the print server on one of your file servers with the number of clients you have, shouldn't be a problem at all. 3. Re-purposing older servers is a great plan. We do the same and it is partially this process over time that allows you to build up a rack or two of great kit. If you buy quality, well spec'd servers, they are still useful after 4-5 years in non-mission critical roles, especially of you have a spare one of similar spec to fire up if something goes down. Our backup server now runs on one of our 4.5 year old previous ESXi hosts, so it is a very well spec'd backup server, which means backups run fast! 4. What do you plan to use for backup storage? This is the one place where RAID5 using good quality SATA drives (WD SE for instance) can be used relatively safely and save you a few dollars. Another option is to do what we did, build your own server with at least 4 drives, 16GB+ RAM and install FreeNAS for rock solid ZFS backup storage. If you have an older server with several SATA drive bays then you have a great inexpensive backup storage solution as long as you use quality drives.

Honestly, if you haven't done any more planning than that the day before a major upgrade - then you should probably have postponed the upgrade entirely. The day before is not the time to making that sort of decision.

An essential part of your backup strategy is to always have (at least) two copies of your backups. Whether you achieve that with disk or tape is another matter, but one of the copies should either be off-site if possible (100m away isn't quite off-site) or as a second best choice stored in a fireproof, waterproof storage such as the iOSafe drives.

U have to erase, then partition the drive as the first step in the workflow and make sure that your Windows image is not larger than the bootcamp partition. That will get you every time.

Sheridan, this behaviour is the default for most devices. They will keep the WiFi SSID that you are using for the provisioning unless you remove it from the memory of the device (Preferred Networks on a Mac, and you have to tell iOS to "forget" the provisioning network). In fact, I find that open (non-secured) SSIDs are usually preferred by many devices when they are aware of multiple SSIDs in the area they can access. We made this step part of our BYOD setup instructions for students and staff. Another method that we have used is to setup the "open" or provisioning WLAN to be used for enrolling iPads and Macs to our MDM system. The MDM system then installs the appropriate WiFi profile. This isn't making use of Zero-IT, but we switched to this because it gave us a bit more control over everything. However, the end-user still needs to tell their device to "forget" the provisioning WLAN or they will keep connecting back to it. This isn't the fault of the Ruckus WiFi system though.

I suspect you might be talking about the Zero-IT config rather than the Guest WLAN feature in Ruckus? Otherwise, I don't know why a student lacking an admin password on a computer would have anything to do with it?

What version of Ruckus firmware are you using because Ruckus guest access works fantastically for us. I've set it up so that either IT, reception or the librarian can issue guest passes with ease. It works just fine on iPads, iPhones, Macs, and Windows 7, 8, and 8.1. Haven't tried it on a range of Android devices, but despite the wide range of hardware and OS builds out there with the thousands of possible configurations, it should still work fine on most.

1) McAfee - Not a chance. Horrible. 2) Kaspersky - Maybe. It was a decent AV solution the last time I used it. However, I haven't personally used their enterprise deployment and management console to give feedback on that part of it. 3) F-Secure - Good rep, but zero experience with it, so can't say. What's making you ditch Avast, BTW?

And what will you be replacing Avast! with? I've found it to be better than most, especially Sophos which caused us so much grief back in 2012.

I think they mean to place the printers onto a VLAN / subnet that only the print servers have access or can route to. That way, no client requests can be sent directly to the printer. Exactly what problem are you trying to solve with these sharp devices (photocopiers?) and Papercut anyway?

I think there is something up with the DHCP settings for this VLAN. Have you tried deleting the DHCP scope and recreating it? I use a dhcp3 server on Ubuntu for my DHCP (2008r2 AD and DNS though), and don't use the Windows DHCP, so the config a aren't what I'm used to on the DHCP server

So, the client isn't getting the DNS settings at all then. What about the default gateway, is the client receiving that from the DHCP server?

What happens if you change the name server in your DHCP scope from 8.8.8.8 to one of your internal DNS servers?

Also, if you don't have a NET VLAN that you have untagged the Meraki AP onto, then I would think it would also need to be untagged on the default VLAN.

Just looking at your original post. Have you tagged the ports on the core switch to the end point switch for the VLAN used for your switches (if you have one). We use a NET VLAN (2) that all of our switches as well as the firewall reside on. Also, have you untagged the ports going to the end point switch on the default VLAN (1)?

So, your clients are getting a DHCP address properly, but not the DNS settings (as you seemed to indicate manually configuring 8.8.8.8 in your client DNS settings works)?

Can you show me the scope for the 172.16.0.0 VLAN?

I don't understand your name server settings. Is your router (172.17.0.254) a DNS server? And why is Google DNS your primary DNS server? You don't need to resolve internal DNS names?

The only catch is, make sure everything is backed up well, especially if you only have one host. All the eggs in one basket as they say.

How do you have your DHCP settings configured for this VLAN? It doesn't seem that you have either a default gateway or DNS servers set in DHCP. All I see above are the switch VLAN settings. This is only half the solution.

Do you have a default route configured anywhere for this VLAN? The default route should be within the subnet range of your VLAN. For instance if you're using 172.17.10.0 with 255.255.255.0, then default route might be 172.17.10.254.

This solution doesn't work so well if you are using Google Apps for your school. It wasn't my choice to use Google Apps mind you (and I would block all of Google.com if I could), but if I do something to foul it up it will be my neck in a noose not Google's. EDIT: Yep, Wordle and dozens of other sites come up when I check my logs that use "appspot.com" domain and that's just from the past week. If I blocked appspot.com there would be a firestorm of grief we would get from the teachers and students. Anyone else have a less destructive method of blocking Snapchat? I can do it for Android devices, but not iOS.

No, then you just need to worry about IE updates keeping up, and not breaking anything

Sounds like the internet services available for UK schools leave a lot to be desired...