HPlum78

Ah 10 is a much better number of DCs to have. We had one per user at one point :-p

@mikkydoos 5 DC for failover how many geographical locations do you have? And what risk have you identified that requires that amount of DC's? If your power goes out do all your DCs go dark? Is the question I will ask..

I know what @Tefters has said is correct people have a fear of in place but from an MS perspective its the recommend way and is fully supported. DHCP MS don't have a definitive answer to if you should or not run this on a DC, there is an artical from memory about making sure you change the account that DHCP runs as if you are running it on your DC and allowing for dynamic updates to NS recs. As for the number of DCs 2 for any secondary school should be plenty as long as they are speced right. (unless your data center DR policy specifies differently then follow that!)

In place upgrades if you ain't changing hardware.

Need to take a look at the data in the meta verse, should be able to solve the issues would need to mach up what's in the connector spaces. It's not a job that could be done via this forum tho and if you have access to MS prem then get those boys on it.

TBH you only need on prem exchange for the schema updates and having access to the management console. SMTP use IIS for the purpose of that traffic no point having an exchange install for that. Nothing stopping you routing your messages through an on prem box although if you are using the likes of spf/ dkim it will look like everything has been submitted from one location. Bite the bullet get shot of the sophos box and use ATP as your on prem sophos box is not throwing up a VM and detonating mail/ attachments like MS does.

@AButters makes a good point around the cost of cloud, Sky was free until it wasn't! Now the only thing that stops edu from being charged is MS/ Google want their products in front of students but I am sure when that no longer makes sense things could change! As for server costs not sure that the cost of hardware as come down (the Reg artical posted in this very thread seems to say the same) like for like its more than it was last year. I reading HP's recent channel news looks like another increase this year as well!

Ah yes a blacklist will stop you...

@Mr.Ben has got it for me try to get shot on your of prem tin and use the right bits of the cloud to deliver a service. Managing tin is time and money wasted and its not the part of your IT statergy that deserves any time. Spend your effort being transformational.

Green field site = cloud. The business would have to make a very strong case for building data center on site. Central server room hub/ spoke setup, i would argue that you have built a cloud and would guarantee that you will not be doing it as cheap as MS/ AWS. (nor have you taken into consideration the redundancy that a cloud can offer, I would guess you are not going to come close to) I am unsure of the workings out of the actual cost of running a sever on site... I see no costs for cooling/ maintenance for all equipment involved and disposal, this is the short list! (all of this makes it a little more than £100-150 a year) I have said this more than once, for those who are not in a position to migrate to the cloud. Its low hanging fruit, you are not going to save a penny if you are consuming IaaS that's just not smart. Also its no use mixing and matching so if an application is going to have a dependency on something on prem then it's on prem until you can bite the bullet and cloudify an entire solution. SaaS solutions are where the biggest savings are, PaaS after that. An SQL PaaS solution in azure works out cheaper than building an on prem solution for the average workloads. An IIS Web site/application can be run for pennies if the right plan is selected. Azure functions costs are less than that as MS use the cycles that those people running VMs don't make use of (don't tell them mind!) something that you cannot do in you centralised data centre! (unless you have built your own service bus) No on prem hardware is a long way off for most, selective cloud is here and we should use it where it makes the most sense.

I don't know if the following will help you get to a working/ better config and may answer you question of what has changed! https://docs.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-office-3

A full sync (or initial) is not required if you are already syncing (in the most part) if the schema changes or you add/ remove attributes then you do an initial sync. In a round about sort of way, full syncs don't need to be run and should be thought about as while the full sync happens you will stop the provisoing of new objects. (if i do a full sync then thats a four day process and that's on a very well connected link!)

You would need to run it from the server where aad connect is installed

Start-adsynccycle -policytype delta Oh and its not random Get-adsyncscheduler will give you the timing It's 30 mins default I think...

Replace the.Where with a |? {$_.online -eq $true} I think... Could be wrong but have not got PS handy and it's late! It's a version issue and we should have declared the version required to run.

so the code looks like this:- [system.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic') | Out-Null $OU = [Microsoft.VisualBasic.Interaction]::InputBox($Inputbox, "Active Directory", "$OU") $Inputbox = "Please enter required OU" $allComputers = Get-ADComputer -Filter * -SearchBase "$OU" | Select-Object Name Add-Type -AssemblyName PresentationCore,PresentationFramework $ButtonType = [system.Windows.MessageBoxButton]::YesNo $MessageIcon = [system.Windows.MessageBoxImage]::Question $MessageBody = "Would you like to force a Group Policy update to this OU ?" $Result = [system.Windows.MessageBox]::Show($MessageBody,$MessageTitle,$ButtonType,$MessageIcon) If ($Result -eq 'Yes'){ #If user answers yes: foreach($computer in $allComputers){ #for each computer found: $computer | add-member –membertype NoteProperty –name Online –value (Test-Connection -ComputerName $computer.Name -Quiet -Count 1) #add a member to object to store if the computer online (True/False) } foreach($computer in $allComputers.Where{$_.Online -eq $True}){ #for each online computer try{ Invoke-GPUpdate -Computer $Computer.Name -RandomDelayInMinutes 0 -ErrorAction Stop | Out-Null $computer | add-member –membertype NoteProperty –name GPUpdate –value "Successful" -PassThru #invoke gpupdate on remote computer } catch{ $computer | add-member –membertype NoteProperty –name GPUpdate –value "Failed" -PassThru #add a member to object to store GP Update Failed message } } } $allComputers Oh I took the -force off the invoke-gpupdate line as well, if i was approaching this with PS i would look at putting in some checks around the user inputs (check for nulls and the like) also maybe worth doing a count on the number of computers and limiting the max number that the script will run against and the like.

foreach($computer in $allComputers.Where{$_.Online -eq $True}){ #for each online computer try{ Invoke-GPUpdate -Computer $Computer.Name -RandomDelayInMinutes 0 -ErrorAction Stop | Out-Null $computer | add-member –membertype NoteProperty –name GPUpdate –value "Successful" -PassThru #invoke gpupdate on remote computer } catch{ $computer | add-member –membertype NoteProperty –name GPUpdate –value "Failed" -PassThru #add a member to object to store GP Update failed message } } } $allComputers Just took away the need for the if statement that you have doing the error trapping as try catch is what i would say to use as that's the default error trapping built in for you. Just need to be careful when you start using -erroraction as you may take the error off the pipe and make your try/ catch blocks not work as expected.

So age.... This is not an issue or outage anyhow that about sums it up for me!

Again the fear of what might happen, I might step out into the road and get hit by a bus... You may update the schema in your root forest and break your entire world. It's all about risk assessment, identifying those risks and having a sensible approche to mitigation and recovery. We all know of the place/ person who got hit by the bus and we modify our pratices so not to get wiped out. That should not be never cross the road or remove the buses!

First thing that springs to mind is we have a number of bits of software that if we want to run them in multiple domains costs us more in licensing, and additional hardware to run those bits of software. Even if you don't have software there are extra DC's that are associated with a multiple forest/domain setups or are we not including those as a cost these days? And with those extra DC's comes a schema and a bunch of extra FSMO roles identity Mangment (add any number of bits of undying infrastructure here) and ultimately you or your technicians time again you could argue that your time is a sunk cost but that's why you will only ever administer IT!

I am with @localzuk on this, and TBH I would argue that it would be less painful to have a school split away from a flat domain and have them stand up a couple of DC's than splitting up a forest.... and as already noted you cannot live your life worrying about what might be as this will 1, cost you more money to deliver a service and 2, slow you down and stop you being transformational in what you are delivering (you will only ever administer your infrastructure). I am sure I have said this in more than one post on here!

@twistefhelxis I am going to guess that DNS is AD integrated and if you are going to take down a DC for more than just a reboot then you should be lowering the weight and priority of the DC locator service before you turn off a DC (even if it ain't AD integrated DNS). There are gpo settings for doing just this in /System/Net Logon/DC Locator DNS SRV records (Set Priority in the DC Locator DNS SRV Records and Specify DC locator DNS records not registered by the DC's) are the settings (you need to find the Mnemonics for the second setting) Not sure that DNS is the issue here but the above will save you from introducing a whole new set of issues if you want to take a DC out of service for a while.

General rule of thumb is to start with a flat AD infrastructure, then let the business and or technical/ legal reasons define the need for additional domains. Look for the MS solution accelerators for AD architecture they will point you in the right direction.

@gomalley have you passed a user that is having trouble in to the function I posted above? This will read the actual policy off the account and will help you track down what is going on.

function Get-UserPwdPolicy ($Identity) { $UsrDetails = Get-ADUser -Identity $Identity -Properties * $Fgpp = (Get-ADUserResultantPasswordPolicy -Identity $Identity).Name [string]$Policy = switch ($Fgpp) { $null {"Default Policy"} {!($null)} {$Fgpp} } $Return = New-Object -TypeName PSObject $Return | Add-Member -MemberType NoteProperty -Name Identity -Value $Identity $Return | Add-Member -MemberType NoteProperty -Name PasswordPolicy -Value $Policy $Return | Add-Member -MemberType NoteProperty -Name Enabled -Value $UsrDetails.Enabled $Return | Add-Member -MemberType NoteProperty -Name 'Password Never Expires' $UsrDetails.PasswordNeverExpires $Return | Add-Member -MemberType NoteProperty -Name 'Password Last Set' $UsrDetails.PasswordLastSet $Return | Add-Member -MemberType NoteProperty -Name 'Password Expired' $UsrDetails.PasswordExpired $Return | Add-Member -MemberType NoteProperty -Name 'Canonical Name' $UsrDetails.CanonicalName return $Return } The above function will get the password policy being applied to an account. if you want a very dirty way of getting the list out you can run the following:- Get-ADUser -Filter * -Properties * | % {Get-UserPwdPolicy -Identity $_.samAccountName} | Export-Csv -Path C:\tmp\UserPwdPolicy.csv -Append -NoTypeInformation not in code block as I always warn about running any command with -Filter * -Properties * (is bad just bad!) hope it helps.