Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am transitioning a bunch of roles and other functions (I am not sure if all of them are strictly "roles") from server 2003 to 2008 R2 and am wondering how I should break them up.

Specifically what roles should I isolate from others, and such. I'm fairly new to Windows Server administration but have done some reading. Things I've already read include

  • don't run RRAS on a domain controller
  • try to avoid running Exchange on a domain controller

Our office has 40-50 users, and around 100 PCs - that should give an idea of the workload.

Here is the list of roles:

  • AD (single forest, single domain) - redundant on separate hardware
  • DNS - redundant on separate hardware
  • DHCP
  • IAS for RADIUS
  • RRAS for VPN
  • WSUS
  • Exchange
  • IIS (for webmail only)
  • KMS
  • Certificate Manager / keystore service (unsure of exact name)

My current plan is:

  • VM 1: AD, DNS1, DHCP1, IAS, Certificate Manager
  • VM 2: AD, DNS2, KMS, WSUS
  • VM 3: Exchange 2010 (all 3 roles, I think we're small enough), IIS
  • VM 4: RRAS

I had originally hoped to start with 2 servers/VMs and go from there, but given that I don't want Exchange or RRAS on a DC, my assumption is it's worth the cost of a couple extra server licenses both for configuration and security. I have no idea if it's worthy keeping one DC as pure as possible and loading the other with all the basic serices, or if I should just split them 50/50.

What kind of changes should I make? Is it feasible to do this in less than 4 VMs? Are there any conflicts I have not identified?

UPDATE: I am dividing the VMs between two physical hosts to start. One DC on each physical host.

share|improve this question
up vote 3 down vote accepted

I don't think that you can run AD Certificate Services on a domain controller, so you might have to move that somewhere else. For a small place, that's probably fine, otherwise. Though, I do always recommend trying to run only AD and DNS on DCs whenever possible. If there's any way to squeak out another box, you might be best off putting IAS, Certificate Services, DHCP, and WSUS on it.

After reading what Holocryptic wrote, I re-read your question. I didn't realize that you were putting all of this on one physical host. You're definitely going to want at least two physical servers. One of the main reasons that you don't want a DC with Exchange on it is because of all of the disk I/O that it would cause. If you have them on the same physical host, then you'll likely be sharing disks and facing the same contention issues. You really need at least two physical boxes here.

share|improve this answer
You can run ADCS on a DC, but it's best practice to have two ADCS installs: a standalone root (which is kept offline except for issuing new subCA certs) and an Enterprise subCA (we keep ours on a DC). – Chris S Jun 29 '11 at 19:26

In addition to what MarkM says, you may want to try and get some physical resiliency there too. If your one VM host goes down, you lose everything...

share|improve this answer
Yes, a good point. I'm not intending to put all my eggs in one basket. There will be 2 physical hosts to start – Joshua McKinnon Jun 29 '11 at 19:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.