Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

At the moment, we have 1 machine running IIS, SQL server, Active Directory, some kind of Quickbooks service..., DHCP, DNS, and VPN server. It's... precarious. There are about 10 people inside the office, and 30 that hit the web server once in a while. I'm trying to get 2 more boxes, or at least one more, to split this stuff out onto.

I'm thinking something like:

    1. Web/App stuff
    1. AD-1, DNS
    1. AD-2

Where does DHCP go? I've been reading through all the Active Directory questions here and, some places say, DHCP on AD machine is bad security idea while others talk about all the benefits of AD,DNS, and DHCP talking to each other (on the same machine).

VPN?

share|improve this question
    
Are any of these services going to be accessed from public (ie. the internet)? –  Mathias R. Jessen Feb 18 '12 at 1:19
2  
Any server that is running AD should always run DNS as well; I have never heard a good reason for not doing so. –  Chris S Feb 18 '12 at 3:14
    
@MathiasR.Jessen Just one IIS site and the VPN of course. There's also sharepoint running, which I had forgot about because no one uses it; We are on google apps. I should turn that off. –  tladuke Feb 18 '12 at 6:09
add comment

1 Answer 1

up vote 4 down vote accepted

Running DHCP on a DC is not reccomended, but the risk is lower if you follow these steps http://support.microsoft.com/kb/255134

I actually do this same thing, even thought my DHCP isn't running on a DC.

I think your setup is fine, except I would make the following minor tweaks.

  1. Web/App (as you mentioned
  2. AD, DNS/WINS, DHCP
  3. AD, DNS/WINS, DHCP

one thought, if you could splurge on some enterprise licenses instead of standard (i assume that's what you're running), you could run up to 4 VM's per physical socket, which would give you a lot more flexability. Even if you could run just one physical server as a hyper-v host, that would net you an ability to seperate our your VPN from your other stuff.

share|improve this answer
    
Just be sure to split the DHCP so that you don't have both servers issuing the same addresses. –  John Gardeniers Feb 18 '12 at 11:02
    
Indeed, since we have plenty of IP sapce, we set the scope so that its large enough that any one DHCP server can handle the full load without needing to adjust exclusion ranges. Example, we only need 254 addresses, so we use a /23 subnet (512 addresses) and exclude 254 on each DHCP server. Of course not everyone has that luxury. –  Eric C. Singer Feb 18 '12 at 15:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.