Hardware for a DC/DNS/AD server?

[Mr.Guvernment]

New office move coming, going to be doing a a DC/AD and a DNS server, i was thinking the route of a single server running 3 VM's on it one for each item above.

the office will have about 15 users at most with domain accounts, there will be about 10 servers, so i assume the hardware need shouldn't be super powered or anything?

i was considering raid 6 for the redundancy.

Is it a good idea to run a DC or AD on a virtual machine? or should it be on it's own seperate server?

Do you think a back up DC would be needed? run a a 2nd DC in a VM as backup?

All of the above should run fine in a VM environment i assume?

Should i go with Server 2008, or 2003, i have heard 2003 will be EOL soon..


Any and all input is appreciated, i will be posting alot more questions around matters like these in the coming weeks.

[Levish]

DC/AD/DNS for 15 users will run on a Pentium 2 ...just set it up right according to best practices

if its a new domain, might as well go straight to 2008 server, lots of new features in there

[Serra]

New office move coming, going to be doing a a DC/AD and a DNS server, i was thinking the route of a single server running 3 VM's on it one for each item above.

the office will have about 15 users at most with domain accounts, there will be about 10 servers, so i assume the hardware need shouldn't be super powered or anything?

i was considering raid 6 for the redundancy.

Is it a good idea to run a DC or AD on a virtual machine? or should it be on it's own seperate server?

Do you think a back up DC would be needed? run a a 2nd DC in a VM as backup?

All of the above should run fine in a VM environment i assume?

Should i go with Server 2008, or 2003, i have heard 2003 will be EOL soon..


Any and all input is appreciated, i will be posting alot more questions around matters like these in the coming weeks.

Like Levish said, requirements are pretty low for hardware. I also agree with using 2008 if you can. I can't think of any reason not to.

As to VM's. If you can virtualize, I say do it. That said, virtualizing comes with VMWare license costs (unless you have hardware you can run ESXi on, because that :banana::banana::banana::banana:'s free! But be warned, if it's not explicitly compatible, don't even bother hoping it will work anyway).

For backups - a backup VM will only be of benefit if your VM crashes, which can happen. But it doesn't protect at all against hardware failure. If possible, I would suggest purchasing a second server as well and configuring a secondary on that (preferably in a VM).

Whether you want to split out all the functions you have planned into different VM's is up to you... really, it's a function of how much money you have for licensing (or your knowledge of linux). For such a small office, if you wanted to use one VM for all of it to save costs no-one would blame you.


One question though - those other 10 servers that you say exist: why aren't THEY virtualized? I'm sure you could trim that down to 2-3 servers easily and save tons on energy/heating/space costs. If you can go for full ESX (not ESXi, the free version) you can do it with HA features as well as centralized management too.





Edit: Hmmm. It appears my home ESXi server just purple-screened. Frick. ESX is great, but ESXi really can be a PITA (though mileage may vary, I'm not strictly speaking on recommended hardware).

[zanzabar]

hyperV is better than esx IMO. but what i would do is get a box (cheap low power) then go on ur other server and make a VM.

also go server08 u dont want a domain for 2003 they are bad for the new exchange 14 and have some problems with exchange 12. (13 was skipped)

[Serra]

Edit: Out of curiosity, since you're moving and looking to purchase new hardware anyway... have you considered virtualizing desktops? You can run a desktop with a mini-ITX box these days and do the computing on the server. Much easier to manage, but it does have some limitations (ie. you require a strong network and it's not good for graphics).


hyperV is better than esx IMO.

Dear God no. ESX (especially now that vshpere 4 is out) is definitely in a class of its own.

[ownage]

Atom based server, Gentoo Linux. :up:

And why VM's?

[zanzabar]

Dear God no. ESX (especially now that vshpere 4 is out) is definitely in a class of its own.

i dont have much experience with esx but what i have seen is that it needs drivers built in and it was lower performance than hyperV but i was just on an intel quad box and i havnt used vshpere 4


Atom based server, Gentoo Linux. :up:

And why VM's?

with VMs u can go and make a 2nd DC on another box and it wont take up much resources and its good backup

[Serra]

And why VM's?

One reason I quite like is that if your server OS dies, you don't have to walk up to it and console in - you can remote in to it and re-start the server.

Other reasons include:
- It only takes up about an extra 50 cpu cycles, which in a world measured in GHz is nothing
- You can use the same processor and memory for multiple operating systems, letting you have as many application-specific installs as you want on one box. You can save a ton in hardware, plus associated costs.
- Stateful failover and other HA features are included with ESX


i dont have much experience with esx but what i have seen is that it needs drivers built in and it was lower performance than hyperV but i was just on an intel quad box and i havnt used vshpere 4

I'll give you that the driver support is very picky, but if you're using "standard" equipment generally it's fine. I'm on somewhat non-standard for ESXi 4 right now at home and I've certainly had a few things I've had to work around.

I would be very interested to see the lower performance claim backed up though - my understanding is that ESX offers *the best* performance, and always has. When you add in all the HA features of ESX and the OS-specific support as well I really have a hard time justifying MS's offering. Plus, and this is somewhat to the side, ESX has withstood the test of time from a security perspective but hyperv is still newer.

[Mr.Guvernment]

Atom based server, Gentoo Linux. :up:

And why VM's?


From what i recall, Linux has nothing to compare to Active Directory out yet, they have OpenDirectory but it is not near what AC can do... Also i am a windows guy more so myself, to learn linux and then the programs for it would take me some more time i am sure which i am already likely going to be pressed for.

Basically i have about a month to get a working backend system ideally, if not, i have things i can do in the mean time to control the computers usage and such, cause i am not implementing anything until it is %110!



I do have 4 Dell SC440's rigth now i wasnt sure of what to do with them, they are dual core pentium D's (3Ghz) with 2G ECC of ram each right now, i could toss in a raid card and do 2 or 3 drive raid 1 in them, image the rigs and have 3 of the exact same systems.




One question though - those other 10 servers that you say exist: why aren't THEY virtualized? I'm sure you could trim that down to 2-3 servers easily and save tons on energy/heating/space costs. If you can go for full ESX (not ESXi, the free version) you can do it with HA features as well as centralized management too.


Thats coming! slowly but surely, one issue we have is alot of our back end system were coded over 5 years by one person (PHP front end, MySQL backend), i tried to move everything spread across about 3 HTTP servers to one, with new versions of PHP and apache and such but nothing ran, errors everywhere, the coding is a mess! (the person who originally did it basically was learning as they went and as they learned new things, they didnt go back and fix the old, they just kept going forward)
We finally have some resources in the coding department to basically redo all the old work, which means about 4 of those servers will be tossed into one system and save me alot of headaches!

The other servers are MySQL servers, so VM'ing them isnt too wise due to the I/O that is needed for each one, but i just built a new Dual quad core AMD server., 8 drive raid 10 array, 6G of ram for now, that will take the roll of 2 of those servers over and take that down alot. In the end if all goes to plan for me, i think i should have at max - 5 server's total running everything.

Our development team is sending me 2 spare servers they will have soon, which i will use as the DC and such and virtualization on it, pending on how old they are as i think they are older socket 604 xeon dell rigs :( so Hypoer-V may be out of the question.. (doesnt it need cpus that support Hyper-V i recall)




Edit: Out of curiosity, since you're moving and looking to purchase new hardware anyway... have you considered virtualizing desktops? You can run a desktop with a mini-ITX box these days and do the computing on the server. Much easier to manage, but it does have some limitations (ie. you require a strong network and it's not good for graphics).

....

This thought actually crossed my mind today, the other half of the company that owns us more or less, they are deploying thin clients i found out talking to their lead guy this afternoon, and considering we will have about 7 support based computers, they will all require the same tools to do their jobs, so i am considering a thin client route, single server with said image on it that is loaded out to each client and be done with it, a single user that can be used on all of them for what they need, instead of seperate ones (not that it would matter as individuals would just be under a single group policy anyways..)

The main issue comes with about 5 people who will be in and out of the office, will need normal access for their laptops, marketing, ceo, people like that, what i was thinking to go the easy route, as they will have external access already to the reports and tools they need is to toss them on a vlan, so they dont need to log in to the domain, just connect and go?

With that, i would also sync up with their laptops to do incremental backups of their data when they are connected in the office...thoughts on that? or better ways to do that?


This will all be something new to me for some parts (more so the thin client side, and some of the new goodies gound in 208 DC/AD), i do know some stuff, but i know i will be learning alot of new stuff over the next 2 months, but what ever i can learn to make my life easier in the long run, i am going for it!, already have a massive list of things to get freshened up on (it has been about 4 years since i set up a DC / AD....)


hyperV is better than esx IMO. but what i would do is get a box (cheap low power) then go on ur other server and make a VM.

also go server08 u dont want a domain for 2003 they are bad for the new exchange 14 and have some problems with exchange 12. (13 was skipped)

Ya, i was leaning towards 2008 myself, i like to keep with the newer goods myself, i have dove into all the new goodies yet of what it offered over 2003.

My concern was some of these support systems that they currently have are XP Pro and i wasnt sure how well XP pro played with a 2008 DC/AD system, vs Vista that are one 3 of the rigs we have that were moved from our offices when a merge occured.

At home i have started a VM and installed the 2008 trial and am getting familiar with things, grabbing some new updated books and going from there.

[zanzabar]

with server08 xp/vista/win7 work but with 03 the vista up oses have problems

[MentholMoose]

I suggest putting everything on one server (physical or virtual). A DC runs AD, so they aren't separate. Since you haven't setup a domain in 4 years, I recommend putting DNS on the DC. dcpromo can setup DNS for you, and you really don't want a messed up DNS with AD. Also it is strongly recommended to have a second DC. You might as well go with 2008 over 2003 since there's little reason not to.

As for virtualization, if you aren't doing shared storage (e.g. a SAN), I would recommend against it since most of the key benefits of virtualization require shared storage. If you have a SAN, consider vSphere or XenServer, which support live migration, or wait until Server 2008 R2 is out for Hyper-V with live migration. Also for a production environment I wouldn't recommend Hyper-V or ESXi unless you are buying the respective management solutions (SC VMM for Hyper-V, vCenter/vSphere for ESXi). XenServer is OK since their management tools are mostly free.

In any case, make sure whatever you implement supports a good backup solution!

Also, in my experience ESXi seems to support server-grade hardware pretty well. If you try to install on a workstation or laptop, though, it will be hit or miss (mostly it seems that desktop-grade integrated NICs aren't supported, but you can add almost any Intel NIC).

[zanzabar]

using hyperV its cleaner to make a backup DC virtually in the exchange sql or DPM server. and there is little to no performance loss

[Mr.Guvernment]

In any case, make sure whatever you implement supports a good backup solution!


This is something i am researching right now as well, but havent decided yet, right now our office simply has a server with 8+1(hotspare) SATA drives raid 6 set up which has all the files for people and backups of databases, to which then get burned off to disk in 2 copies, such a slow and painful process!

i was considering a tape backup system from dell for that part, and then perhaps a SAN's for the file sharing and such to attach to the domain, to take that load off of it.



Good to know zanzabar, i figured something somewhere may not play nice, i wish i could wait for 2008 RC2 to arrive, but i dont think it will be in stores until Oct? and i will be needing this stuff for earliest, July sometime, but as mentioned i know i could hold off on most of it, as long as people can do their jobs, the backend can be worked on.
Virtualization sounded good as i didnt think a DC/AD and DNS would use much I/O, but i guess once all the profiles are loaded and such, people logging in, then that would be a different matter....

[rogard]

Please can we have some more information about your existing infrastruture? e.g. what these servers do? Switches /routers/APs you have? how many ip subnets you have? which client OS's are you supporting?

If you have a visio of it that would be great!

Also how does your managament/you feel about Open source alternatives?

[3Z3VH]

If all the services you are hosting are AD and DNS, then there is no reason to virtualize. It will just be a waste of (a LOT of) money in licensing, hard drive space, and CPU/RAM requirements.

When hosting for only 15 client computers, you should honestly just take your lowest powered machine (who's parts are still available for purchase/warranty).

15 people don't need a lot of redundancy in their servers because if the server is down for an hour, it doesn't really hurt much. Just make sure you have enough redundancy that when the "stuff" hits the fan, nothing gets lost.

At the VERY top end, the most you need to host AD and DNS, is two physical machines, both hosting AD and DNS, on a single install of Windows Server, with an off-site tape/optical backup. That way the domain is redundant from one machine to the next, and even if the building gets hit by a meteor, you can still recover. But honestly, how tough is it to re-create 15 user accounts, and some DNS settings ?

My recommendation would be a single server with RAID 1 on low-end replaceable hardware, running one instance of Windows Server 2003, or even SBS. The most you MAY want to upgrade is the NIC.

[Mr.Guvernment]

No visio right now but let me see if i can get you one.

Right now things are small and simple, no controllers, no dns servers,. nothing, just desktops and servers on a single network 2 subnets), 3 internet connections, managed switches from dell to seperate the servers from the users via Vlans.

1.5mb Fiber line in via a Cisco 1700 fed into a watchguard 550E that hands DHCP and firewalling
2 x 4mb/1mb cable lines using netgear routers, used for the office workers and stuff, using a different gateway

these all connect into a Dell 2716 switch, i had a 8 port before spliting things off into a 16 port but moved that out.

from there we have the users on one Vlan and the servers on another.

that is about as complex as it gets for what we have right now.


The new office will be wired to all desktops, i will be using.... 2 AP's in the office in conference rooms, the internet connection into the office is not yet decided as we may be getting it from out co-location next door into our office, the reason why we are having our own network is we are splitting the companies to be seperate entities so we want to split as much as possible.

Management doesnt really care, it is my decision more or less, as long as it gets done :)

Myself, i am not that familiar with *nix beyond playing with ubuntu on my Asus EEE or in a VM here and there., and the other office next to us, is using an all windows based system with AD and such, so i thought it best to stay on the same software level as them, not that we need to connect to them or share domains.

[3Z3VH]

I am still curious... what are these 10 servers for ? Typically one server (depending on scale, and protocol) is enough to host dozens of users. You have a better than 1:2 ratio of servers to desktops, which just sounds like overkill. What program/protocol are they hosting ?

[rogard]

Wheres their file server and email server?

Im guessing you have vlaned off the servers as they are in some sort of DMZ?
The AD/DNS box will sit in the same LAN as the users?

[3Z3VH]

It's usually good practice to have your DNS in the same subnet as the clients it is hosting to minimize routed traffic, and simplify DHCP broadcast zones. In larger networks, of course, this is not an option, but yours is hardly a large network ;)

[Cyber-Mav]

if the machine hosting the vm's dies then it takes out the vm's with it. kind of risky, like having all your eggs in one basket.

[Mr.Guvernment]

here is the server run down, we host all the reporting and customer service systems for the backend of our company, the servers arent just for the local people in the office.

2 Main MySQL servers
4 HTTP servers - 2 with apache, 2 with IIS, problems is in the past the one coder (who was my boss really) put various thing on diff servers and such and in the end, when i tried to move them all to one server, they crapped out, so over the years, even when i got a new server to ptu everything together it was always the "i dont have time to redo that, blah blah blah" excuse.
1 Repository / backup server, users files, database dumps and such
1 system that hosts a remote QuickBooks access for an accountant outside of the country (no VPN cause they couldnt get it to work on their end... not sure how they managed that)
2 systems hosting external API feeds from MySQL databases


Once we are in the new office, we will have a 3rd coder, to which i am kidnapping for about 2 months and their job is to get all the HTTP and API systems into one rig cause i am sick of having 6 servers that could be hosted on one, i did try it myself but kept hitting walls so said screw it, got better things to worry about since i am not a coder by nature, sure i can read code and know what it does, but re-writing it is not my thing.

In the end if, sorry, when things go my way it will be:


2 MySQL servers (one super powered on and a 2nd one for smaller things)
1 HTTP server to host all web based crap, API feeds



then the AD/DC and DNS servers on top of that.

Basically in the company now, i had little say as to how things were laid out, we never had an official "Network admin" so to speak, i handled it all, but if someone said "i am doing this" they did it, and this is the end result, crap all over, also buying new things, the ones above me were always cheap, they though $2k US was alot for a server, wait till they see the $1k Areca raid card i got for the new MySQL server and the $1k in harddrives..lol

In this "ne"w company (basically a massive revision of the current one), i am the one and only network admin for this new network, so everything goes through me and things are going to get changed real quick!

One example, our current coder, uses XAMMP for everything, then complains when he moves it to the production system it wont work and the production system is broken...lo,l i laugh, cause is like, so, your a coder, yet you cant make your code work on a "default" php install? come on!!! so then he goes to the project manager, and he goes and complains to the CEO and CEO just says "do it, just get it working", but that is no more!, if you cant code your stuff to work on a default php / iis or apache installed, your not a coder, you copy peoples work and dont know what you're doing.

But those days are officially over and they got a big suprise in for them! Things are getting done right now, especially with the calculated growth of this new office, with in 16 to 18 months we expect our support staff to double and so on.

So the great part of this is i get to build it from the ground up, i am not taking over anyone else's network, and so if i do it right, if we hire other people to assist me, or if i move on or something, then who ever takes over or comes to assist me, will be able to easily help with the systems.

[rogard]

Are you expecting the AD/DNS server to be a file server or are you expecting the Repository / backup server to become a member server? and moved into the users vlan?

[3Z3VH]

if the machine hosting the vm's dies then it takes out the vm's with it. kind of risky, like having all your eggs in one basket.

You have obviously not worked with virtual machines in any official capacity. As long as you leave the virtual machine file on a redundant drive, it is BETTER than a non-virtual server when you consider hardware failure. If the server dies all together, you simply move that virtual machine file to any other server and open it, maybe change some routing, and your server is back up. If you had NOT used virtuals, you would have to rebuild the entire thing from scratch, or find another server with completely identical hardware as the original.

If you are working with a high-uptime environment, you will be using products such as VMWare's V-Motion, which allows the virtual machine to be handed off to any other virtual host in the farm in a matter of seconds, as far as the user is concerned, there were no outages, and all you have to do is fix the hardware, toss the server back in the farm, and it will take over the virtuals again.

Virtual machines INCREASE your reliability, disaster recovery, and flexibility, at the cost of some performance (arguable depending on the architecture), and licensing.


here is the server run down, we host all the reporting and customer service systems for the backend of our company, the servers arent just for the local people in the office.

2 Main MySQL servers
4 HTTP servers - 2 with apache, 2 with IIS, problems is in the past the one coder (who was my boss really) put various thing on diff servers and such and in the end, when i tried to move them all to one server, they crapped out, so over the years, even when i got a new server to ptu everything together it was always the "i dont have time to redo that, blah blah blah" excuse.
1 Repository / backup server, users files, database dumps and such
1 system that hosts a remote QuickBooks access for an accountant outside of the country (no VPN cause they couldnt get it to work on their end... not sure how they managed that)
2 systems hosting external API feeds from MySQL databases

...

In the end if, sorry, when things go my way it will be:


2 MySQL servers (one super powered on and a 2nd one for smaller things)
1 HTTP server to host all web based crap, API feeds



then the AD/DC and DNS servers on top of that.
...


Oh my... that is terrible ! Web servers are one of the easiest to toss all on one or two boxes. Even if people have individual IPs (not virtual hosts) for their site, you can simply assign as many IPs as you want to a network card, and set the web server (Apache in your case) to respond to all requests to xxx.xxx.xxx.xxx with SiteA's site, and yyy.yyy.yyy.yyy with SiteB.

Using that many servers for web hosting (as you said) is just not smart.

I would recommend you stick with two HTTP boxes for redundancy (not just one), especially if these are client web sites. Downtime for customers is not acceptable.

Also, keep the web stuff standalone, off the domain, and in the DMZ. That way if the domain needs maintenance or has an outage, it will not affect the customers' web presence, and people can't exploit the web servers to gain access to your domain.

[MentholMoose]

You have obviously not worked with virtual machines in any official capacity. As long as you leave the virtual machine file on a redundant drive, it is BETTER than a non-virtual server when you consider hardware failure. If the server dies all together, you simply move that virtual machine file to any other server and open it, maybe change some routing, and your server is back up. If you had NOT used virtuals, you would have to rebuild the entire thing from scratch, or find another server with completely identical hardware as the original.

If you are working with a high-uptime environment, you will be using products such as VMWare's V-Motion, which allows the virtual machine to be handed off to any other virtual host in the farm in a matter of seconds, as far as the user is concerned, there were no outages, and all you have to do is fix the hardware, toss the server back in the farm, and it will take over the virtuals again.

Virtual machines INCREASE your reliability, disaster recovery, and flexibility, at the cost of some performance (arguable depending on the architecture), and licensing.
That's if you are using an enterprise-grade solution and implementation. If you just add the Hyper-V role to a 2008 server and start adding VMs stored on local storage (or do the same with ESXi, or XenServer), and the physical server dies, all VMs will go offline (which is what I think Cyber-Mav was saying... that the immediate impact of the server failure will be higher). If this case, you're right to say that recovering the VM should be easier, assuming you can get the VM files off the dead server or from a backup.

I definitely agree that virtualization might be overkill considering the small number of users (I missed that part in the OP).

[Mr.Guvernment]

i can see both sides, with the VM you have one system running many services, that system dies, all those services go offline, vs if each had it's own physical server, only one service would go down.

our users right now will be small to start, i should have an exact head count on monday, but i am looking around 17 users so far and 5-6 servers total in the end to start.

[3Z3VH]

Even if you use physical servers, instead of virtual... if your DC goes down, you lose all functionality on your domain, because everything is tied together with DNS and AD. All your eggs are in that one basket, unless you build a second DC...

Same with the case of virtuals. If you need redundancy, you set up a second machine, and make all services redundant across the two, to guard against hardware/power failure.

[Mr.Guvernment]

Absolutly, each has it's benefits and con, i personally prefer the VM method, as said, get another system, any hardware, load up the image and off you go again vs redoing an entire system from scratch.

[Levish]

Absolutly, each has it's benefits and con, i personally prefer the VM method, as said, get another system, any hardware, load up the image and off you go again vs redoing an entire system from scratch.

The problem is rarely "redoing a entire system from scratch" since regardless if you go VM or physical you still need to have a backup plan in place be it whatever tape drives, optical or to (separate) disk that emulates tape backups.

And you need to make sure you understand what you need to backup based off what services your environment is offering and the expected recovery times in predicted failure scenarios.

Keep in mind RAID doesn't give you backups, it only gives you redundancy in case of a disk failure, which doesn't help you when you need a file in its state from a week ago.

[Mr.Guvernment]

very true, this day in age everything is imaged or backed up in some for or another (if it isnt, you shouldn't be an Admin or NA), the need to actually reinstall an OS from scratch is something of the past really, or soon to be!

I preach the same to many people "i want to raid my drives for backup" "no raid is NOT a backup!!!" amazing how many people think it is.

[Mr.Guvernment]

My new ram arrived, so this week i will be doing some test runs on setting this all up, Fingers crossed!

[Mr.Guvernment]

i got 2 DC/AD/DNS up and running! woo hoo!

[3Z3VH]

Exchange ! Do it ! Do it now !

[Mr.Guvernment]

haha! i so want to, but i am out of servers for now :), but in the mean time i finally get to build the octocore AMD mysql server with a 8 drive raid 10 :) those parts SHOULD be in tomorrow, and then i get to move our current MySQL to a norco rack mount case and add 2 more Segate 500G ES2 drives and move it from raid 50 to raid 10, i wish i had my camera! my office is filled with boxes and packing foam.. :)

[Mr.Guvernment]

If my new motherboard ever frick'n makes it here!


get this, the first board i got was DOA it turns out, after alot of testing, diff cpu,s ram and so on.

So I am sent a replacement board, retail box and all, I go pick it up today, they sent me a dam EVGA x58 SLI LE motherboard!!!!!!! HOW THE HECK! do you confuse an Asus eATX server board with a god dam gamers board! so now they are overnighting me the Asus board, i hope! too bad over night doesnt mean in my hands over night, but add at least 2 days to that to get to Costa Rica!

They also said they are sending a packaging slip to return the motherboard, but i dont think the guy realized i will be sending it from Costa Rica, which will cost about.. oh $100 or more to send back via Fedex or UPs :)