I am transitioning a bunch of roles and other functions (I am not sure if all of them are strictly "roles") from server 2003 to 2008 R2 and am wondering how I should break them up.
Specifically what roles should I isolate from others, and such. I'm fairly new to Windows Server administration but have done some reading. Things I've already read include
- don't run RRAS on a domain controller
- try to avoid running Exchange on a domain controller
Our office has 40-50 users, and around 100 PCs - that should give an idea of the workload.
Here is the list of roles:
- AD (single forest, single domain) - redundant on separate hardware
- DNS - redundant on separate hardware
- IAS for RADIUS
- RRAS for VPN
- IIS (for webmail only)
- Certificate Manager / keystore service (unsure of exact name)
My current plan is:
- VM 1: AD, DNS1, DHCP1, IAS, Certificate Manager
- VM 2: AD, DNS2, KMS, WSUS
- VM 3: Exchange 2010 (all 3 roles, I think we're small enough), IIS
- VM 4: RRAS
I had originally hoped to start with 2 servers/VMs and go from there, but given that I don't want Exchange or RRAS on a DC, my assumption is it's worth the cost of a couple extra server licenses both for configuration and security. I have no idea if it's worthy keeping one DC as pure as possible and loading the other with all the basic serices, or if I should just split them 50/50.
What kind of changes should I make? Is it feasible to do this in less than 4 VMs? Are there any conflicts I have not identified?
UPDATE: I am dividing the VMs between two physical hosts to start. One DC on each physical host.