2

I was hoping to get some advice here on a web hosting query. We are building an eCommerce website that will basically reside on 2 x web servers (fronted by a load balancer) and interacting with a SQL2008 cluster.

In dealings with web hosting companies, some are trying to sell us an additional box which will be used as a domain controller. They claim that it's better design. Of course, the costs go up accordingly as well.

I want to better understand this - does the DC offer us better support from a security perspective. If we don't have this, what do we risk losing?

3 Answers 3

1

From a security design and maintenance standpoint, having all boxes in an AD domain certainly has advantages: simplified user and service account management, group policy support, centralized permissions, secure communications between all components, and probably more that I am overlooking.

However, it also adds overhead to all transactions - everything goes through the domain controller for authentication.

In the end, you must weigh the added cost of an extra DC against the management and security benefits.

2
  • As these are operational web servers, there should not be many users. Would I be correct in saying that if there's a need for cross server communications (frequent transfer of files, sharing of directories etc) then it's worth looking at a DC. For us, the CRM is all web based, and does not require group/policy management
    – AvgJoe007
    Jan 25, 2012 at 12:01
  • Depending on the number of objects you need to manage, doing it on each individual box may make more sense for you - say one service account for the web services, one for SQL server, and a few for admin users, might be all you need.
    – adaptr
    Jan 25, 2012 at 17:01
1

Pedantically speaking, unless you are using a Windows NT4 domain controller, there is no such thing as a PDC any more.

Adding a domain controller into the mix isn't going to increase security, although it will make authentication slightly easier, but if you must add a domain controller (for other reasons), don't expose it to the internet what ever you do, keep it on a separate server. FWIW it's also standard practise when installing active directory to have a minimum of two domain controllers, otherwise disaster recovery can be 'interesting'.

From the info in your question, I'd recommend that you avoid adding a DC, in fact, I'd suggest that you avoid it like the plague.

You might want to also consider licensing. I don't know if this is something you or the hosting company is responsible for, but if you are currently using the Web edition of server, you will need to upgrade it to standard edition to install AD to the existing server(s), which also means that you will likely need to purchase an external connector license, or enough CALs for your users. This won't be an issue if you use a separate domain controller however.

1
  • Thanks - we do have it on a seperate server.However, I am struggling to justify the added monthly costs. From a business perspective, I don't know how to explain our need for it...
    – AvgJoe007
    Jan 25, 2012 at 12:17
0

If there's not going to be much need to authenticate lots of different connections in different contexts (aka users) from one server going to the other, then I'd suggest that while a domain design may be the purest option on paper, its probably not really needed for what you're doing here.

I'd also agree with the comments you have had already - in particular the comments that if you DO have a DC, it should be a separate box (different virtual machines is fine) that is not exposed to the internet, and that if you have one DC you should ideally have two for redundancy purposes. At that point, a simple and relatively cheap online presence has become rather more complex and costly and i you're not going to be doing anything that will leverage the advantages of AD, its difficult to justify too.

The one thing you might consider is how likely is it that the number of servers and the complexity of interactions between these servers is to grow; there clearly does come a point where a domain does make sense and its much easier to start out with the right design than change mid-stream.

4
  • Thanks Rob - the only real interaction is a robocopy of pdf files periodically from server a to b. All other interactions are under one user mostly with SQL via it's conn. string. Furthermore, this is unlikely to change in the future
    – AvgJoe007
    Jan 25, 2012 at 12:52
  • I'd suggest that you don't need active directory accounts for either of those - a local account will take care of the authentication to copy files and SQL authentication via a local windows account or a purely SQL account, whichever you prefer, will all work just fine.
    – Rob Moir
    Jan 25, 2012 at 12:59
  • Thanks - just a question as I'm not a network guru...If we do go with 2 DC's, can we use them to authenticate against for our local office network? Or is it not normal to have DC's at your hosting provider? (We have a huge internet pipe going out)
    – AvgJoe007
    Jan 25, 2012 at 13:43
  • @AvgJoe007 - I'd say that its not normally the done thing - not only would you have login issues if the connection was down for some reason, there is still the matter of latency to consider even with a fast internet connection. If you wanted your local machines and your hosted machines to authenticate against the same active directory infrastructure, which is reasonable enough, I'd consider having one of the DCs in your office and the other in the hosting facility, connected via a VPN.
    – Rob Moir
    Jan 25, 2012 at 13:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .