Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Need help designing Active Directory for a client who has 4 branch offices and one head office. The 4 sites have people email IDs in Same primary domain as well as 2-3 more domains, which are sister concern companies for the Primary company.

Should I use SBS or use 2008 R2?

I'm too closing down to single forest/domain but want more idea on how to create my FIRST server. what I plan is:

Primary domain: company.com

Other regd. company domains: companyLABS.com, companyTECH.com

4 sites have people working for all 3 domains stated above. So I plan to make 4 sites:

site1.company.com
site2.company.com
site3.company.com
site4.company.com

Above 4 sites will have 1 + 2 domains hosted which are listed above

All above 4 sites will be part of one major AD: company.local (company.com). This AD server will be at a 5th location where the IT manager will have physical access to only this Primary server, she'd be controlling all policies from this which will be in affect on other 4 sites...

Please shed some more light on the plan....really appreciate your help ------- some update-----

thx guyz, I'm overwhelmed by your response and knowledge share...

Yes, I do plan to use Exchange.. but later once all data is centrally managed, practised and adapted by the underlying users at all 4 sites. There are a total of 5 email domains that will be required....

I'm closing down to NOT USING SBS for this project..

Answering "smassey", this customer is not using any collaboration tools like sharepoint etc. They don't even have client server architecture at the moment.. all computers at different sites operate in a hay-way workgroup mode. No centralization at all.. That is the concern for the stakeholders, as the company has grown more than 5 folds in past 5 years, they are a pharma company who is into 1. Manufacturing medicine -Labs and Pharma plant (primary domain) 2. Research in Bio technology 3. IT arm of this company making ERPs for pharma companies. They develop & sell customised Software to many small and medium pharma companies (small team of 15 people)

As stated, I'm to start from scratch for them, so instead of rushing to put up a server there, I want to dedicate time in planning...

Answering "sysadmin1138"

At the moment, we need to start with first H.O. with around 25-30 people. I need to put a first server there, configure "AD for this site only", configure folder redir for users and if possible create exchange for them too!! Then give this a test run for a month or so. This AD can be remotely managed by the IT Manager and "me"

Likewise once the stake holder's are satisfied, we move to second site, do the same, put a server there, centralise data adn move to third and 4th site

Once all 4 sites have 4 Servers (4 ADs) setup and running separately, the IT manager, who heads the ERP development team and sits at the 5th Site, will get a NEW Server, which will be configured to be as the SUPER AD. all 4 previous servers will connect to this one server for AD backup (data backup will be treated seprately per site) and will impose policies to underlying 4 servers as set on the SUPER AD.

my explaination above my not adhere to how AD actually works, but thats how the flow of action needs to be with the client. SO I seek some pointers on how to design EACH SERVER individually for each site, so that later when all 4 sites have servers, we can create trusts between them, or join all of them to a SUPER AD to get their policies etc..

I hope I was more clear on the scenario, thanks for reading up...

And yes, I'm reading the links and books that you mentioned.. but pls do give you opinions so that I can get away with the design part soon....

Regards...

share|improve this question

closed as not constructive by Ben Pilbrow, Iain, gWaldo, voretaq7, MDMarra Nov 29 '11 at 20:16

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
I believe with SBS you can only have the one domain and no subdomains...I may be wrong, however. –  tombull89 Nov 29 '11 at 12:35
2  
Not a question. I suggest you rewrite this fast, or it'll get deleted soon. –  Roman Nov 29 '11 at 12:37
    
Researching the capabilities of different products (SBS vs. Standard) is basic prerequisite homework. If you can't be bothered to put in even that much effort, you will not find this community to be willing to help. –  gWaldo Nov 29 '11 at 13:28
add comment

3 Answers

The thing to keep in mind about Sites in AD is that they make more sense when there is a Domain Controller hosted in the Site. If you have one AD server in a central location, it doesn't make much sense to have multiple Sites declared; though if you are planning for growth and will eventually have more than one domain-controller, declaring them now makes some sense.

Also, you can declare new Sites later on.

What I suggest:

  • Don't use Sites at first.
  • Do enter the Subnets into AD Sites & Services as you create them.
  • Put the DC in the central location.
  • When it comes time to add a second DC, one in a branch office, THEN declare a new Site.
    • Pay attention to your Replication Schedule. The default is once every four hours, and if that isn't often enough you'll have to tweak it.

The timing of the second server will be impacted by load on the WAN links. All GPO-related files will be coming from the one Domain Controller, as will all authentication. If your links are smaller or congested this can lead to significant policy-application delays.

From what I'm reading the multiple domains you're talking about are email-domains, not AD domains; everything is in the same AD domain here. This suggests Exchange is involved in here somewhere. Exchange can handle the multiple-email-domain/single-AD-domain environment.

share|improve this answer
    
Thx all... I updated my main question as per your suggestions.. kindly read and reply accordingly –  mehargags Nov 29 '11 at 19:44
    
thx guyz, I'm overwhelmed by your response and knowledge share... Yes, I do plan to use Exchange.. but later once all data is centrally managed, practised and adapted by the underlying users at all 4 sites. There are a total of 5 email domains that will be required.... I'm closing down to NOT USING SBS for this project.. –  mehargags Nov 30 '11 at 0:46
add comment

Whatever you do, don't use SBS. It's limited to a maximum number of users and only lets you have a single domain and a single domain controller.

That said, you should really have a better look at how Active Diretory works; domains are to be kept to a minimum unless you really need them: sites and OUs will help you delegate administration and permissions, and will be more than enough in most scenarios.

Active Directory design can get quite a big and complex topic, and it requires not only a good knowledge of how AD works, but also a good understanding of the customer's requirements and how they can be mapped to the various tools AD gives you.

This is a good place to start:

http://technet.microsoft.com/en-us/library/cc754678(WS.10).aspx

share|improve this answer
2  
I'd disagree with your statment of "don't ever user SBS", SBS has it's place, not for this situation granted, but there are plenty of small business situations where SBS is a perfect fit. –  Sam Nov 29 '11 at 12:43
    
That's what I was meaning, don't ever use SBS in your situation; sorry for skipping that. –  Massimo Nov 29 '11 at 13:25
add comment

How you design Active Directory for your customer is going to depend on a number of factors. You already mentioned one - number of remote sites. Are you also going to be using Microsoft Exchange for your email? Does this customer use any Active Directory integrated applications like Sharepoint, and are they doing anything like desktop virtualization?

These kinds of questions help you understand the entire environment and make solid recommendations on the number and placement of domain controllers.

Microsoft's best practices for domain naming are to avoid using routable domain names like "company.com." The best practice is to use a domain name like "company.local" to avoid issues with DNS.

You also need to think about redundancy. Since this domain will be serving five sites and Active Directory ties into DNS, you will need to have additional domain controllers, otherwise your network will cease to operate if your domain controller goes down. I would suggest building at least two domain controllers in your central site to start with. If you need more, or your remote users start to experience long log in times or other issues, you can always add domain controllers at your remote sites.

Even if you don't plan to take the exam, I would recommend that you pick up a copy of MCTS Self-Paced Training Kit (Exam 70-640): Configuring Windows Server 2008 Active Directory. This book goes over the basics of Active Directory, and it has examples that you can work through at home to give you more hands on experience.

share|improve this answer
    
Answering "smassey", they are not using any collaboration tools like sharepoint. They don't even have client server architecture at the moment, all comps at sites operate in a hay-way workgroup mode. No centralization at all.. Thats a concern for stakeholders, as the company has grown more than 5 folds in past 5 years, they are a pharma company who is into 1. Manufacturing medicine -Labs and Pharma plant (primary domain) 2. Research in Bio technology 3. IT arm of this company making ERPs for pharma companies. They develop & sell customised Software to many small and medium pharma companies –  mehargags Nov 30 '11 at 0:49
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.