what windows server should I choose for Active directory?
-
A huge thing that needs to happen in tons of companies around the world is realizing that they shouldn't be lazy and try to get technology to do some one else's job. i.e. you don't want users surfing the web at work, that's an HR policy, same goes for installing software on the PCs. Now - that's not to say that you don't use technology (like not giving them local admin rights) to keep your environment safer, it should be purely seen as a secondary line of defense, not the primary - again, that's HR.
-
For 100 users, I would definitely say that a single Hyper-V host will be enough and no need for a second DC VM.
With the ability to backup to unitrends for free (do they still offer that free for up to 1TB?) and the ability to just overnight replacement parts, things could easily handle a hardware failure.
-
When it comes to deciding if you should even use AD or not, my question comes down to this, "What do you gain?"
Would centralized accounts actually gain you anything? Because if the applications are hosted, then you are not likely going to get AD benefits to that.
-
You can use a product like Atera (https://www.atera.com/pricing/) for $80 a month to gain insight into your devices.
- It includes a ticketing system.
- You can force patching.
- You can make a script (example) and push it from Atera (or any service really) to setup a local admin account and update it whenever you need.
- You gain remote support functionality for a single user.
- Atera offers antivirus integration and backup integration if you want to pay for that also.
-
For third part applications installed on the user computers, you can use Chocolatey for many normal things.
Then you can use Atera to force that to run updates whenever you need.
-
@Grey said in what windows server should I choose for Active directory?:
@Dashrender said in what windows server should I choose for Active directory?:
@Grey said in what windows server should I choose for Active directory?:
Since you're starting with a clean slate, I suggest you go with server 2016, and set that up on a robust hypervisor like Hyper-V (so you can leverage some license benefits and save money). Be sure to talk to your MS resale rep and get your licensing under control before you really embark on your design. Once you are satisfied that you and your reps have the licensing planned out, get a pair of domain controllers set up with both of them running DNS and DHCP -- do not use Cisco devices despite what your cert training said; just use helper addresses. Both servers should be set up and running as a peer (the concept of primary and secondary domain controllers is a dead concept, despite what your computer engineering degree or professors may have said). They will have the ability to fail over, and tehy should not be running on the same hypervisor platform (yes, you need 2 hypervisors -- 2 hosts). If your business is cheap, you can get away with a single hypervisor and 2 servers (guests) on them, though you need to explain the concept of uptime and service requirements to them if that's the case. Of course, it's the business that makes the decision on how much to spend and, I gather that they've hired a Jr. SysAdmin to do Sr. work, so they're likely unwilling to spend on infrastructure. Check with xByte and/or Stallard Tech to see if you can get some good second-hand equipment.
You make this blanket recommendation of a dual physical server setup without knowing the environment at all. If there is no need for a second physical server, this is a pretty huge expense that probably isn't needed, for something that doesn't fail that often - and even if it does, can often be easy to get around while repairs are made.
Is it the best, of course it is, but is it necessary? Often it's not.
Just like the idea of an AD in general. Does he need it? He already had 100+ devices deployed and has no AD, it might be better to go another direction altogether.These are things your CDW sales rep won't consider for you - instead they will simply ask you how many servers you have - OK you need that many server CALs, how many end points, ok that many CALs, etc. But one thing they won't offer is that you don't use AD all, instead use Atera to manage the PCs, and don't worry about local logons. (now that doesn't mean that during deployment you still couldn't setup a local admin account that you know the username/password to and setup the user as a non local admin).
¯_(ツ)_/¯
We have different design philosophies and implementations. My goal is reliability. Yours is ... well, something else.
http://i.imgur.com/YrO0tQg.jpgReliability should always be in a business context though. The vast majority of the SMB market should not consider a secondary AD server because the cost of the extra reliability is higher than the cost of the outages from AD being down. Reliability should never be a thing on its own, always a mitigation of a specific business risk tied to a cost value of the mitigation.
-
@Alan said in what windows server should I choose for Active directory?:
okay, maybe the AD is not the way to go! based on some comments here and some other groups as well. what is the alternative way to manage around 100-150 device without active directory?really what we are looking for is being able to access those computers when needed and being able to restrict some users from changing things or open some website or apps. For example one of the managers was asking me if we can have the same background on all the devices and restrict users from changing it.in short what is or are the alternative solution to manage and administrate that number of users and devices without AD?
Alternatives include:
- AD but not from Windows
- Azure AD
- nothing at all, is there even a need?
- MDM style tools
- DevPs tools to manage desktops like servers
- Scripts
-
For me, it depends on the clients/users OS. For example if I have an environment full of Windows 7 SP1 users f go with 2008 R2 SP1
Due to I believe that server OS would've been tested plentiful using that client OS.
If you have mixed bag of client OS, go with the latest.
-
@msff-amman-Itofficer said in what windows server should I choose for Active directory?:
For me, it depends on the clients/users OS. For example if I have an environment full of Windows 7 SP1 users f go with 2008 R2 SP1
Due to I believe that server OS would've been tested plentiful using that client OS.
If you have mixed bag of client OS, go with the latest.
This argument is still invalid. Why would you go out and purchase an old operating system, to support your old work stations?
You upgrade or run the most current (outside of beta software) because it offers you the most benefit, and comes with support for the longest period of time.
Server 2016 is completely compatible with Windows 7 (which is now 8 years old). Running Server 2008 is even older than Windows 7!
You'd purchase CALs for whatever clients / users you have no matter what, but never purchase out of date software, to support other out dated software.
-
@msff-amman-Itofficer Now don't get me wrong, I understand not wanting to have to purchase new CALs because those can be expensive, but then I guess the question is; Why are you using Windows at all if you can't afford to keep current on a regularl refresh window?
-
@DustinB3403 said in what windows server should I choose for Active directory?:
@msff-amman-Itofficer Now don't get me wrong, I understand not wanting to have to purchase new CALs because those can be expensive, but then I guess the question is; Why are you using Windows at all if you can't afford to keep current on a regularl refresh window?
I can hear my voice echoing in many of these threads, even when I am not around
