Questions asking for best practices in a given field. Be aware, that sometimes there might be no generally accepted best practices, in which case the question is likely to be closed for being subjective.

learn more… | top users | synonyms

66
votes
5answers
40k views

Top level domain/domain suffix for private network?

At our office, we have a local area network with a purely internal DNS setup, on which clients all named as whatever.lan. I also have a VMware environment, and on the virtual-machine-only network, I ...
64
votes
5answers
4k views

Choosing between meaningful and meaningless hostnames [closed]

Assume an environment with a puppet-managed cluster of different servers - various hardware, software, operating systems, virtual/dedicated, etc. Would you choose meaningful hostnames ...
45
votes
7answers
5k views

Cable Management Policy

We've all seen good and bad examples of cable management. What are objective, measurable requirements that can be used in a policy to maintain cabling order in the rack/server room/data center? ...
42
votes
7answers
12k views

Best Practices in Username Standards: Avoiding Problems

I'm interested in finding out what people's experiences with standard usernames is. I've always been in places that used {firstInitial}{lastname} (sometimes with a length-limit). Now I've users that ...
37
votes
4answers
35k views

Windows Active Directory naming best practices?

After experimenting with Windows domains and domain controllers in a virtual environment, I've realized that having an active directory domain named identically to a DNS domain is bad idea (Meaning ...
31
votes
8answers
14k views

Should I expose my Active Directory to the public Internet for remote users?

I have a client whose workforce is comprised entirely of remote employees using a mix of Apple and Windows 7 PCs/laptops. The users don't authenticate against a domain at the moment, but the ...
31
votes
7answers
2k views

What would you do if you realized your email hosting provider could see your passwords?

We received an email last year from our hosting provider regarding one of our accounts- it had been compromised and used to deliver a rather generous helping of spam. Apparently, the user had reset ...
30
votes
7answers
8k views

Is it best practices to have separate login for a domain for domain admins?

I typically like to set up separate logins for myself, one with regular user permissions, and a separate one for administrative tasks. For example, if the domain was XXXX, I'd set up a XXXX\bpeikes ...
26
votes
12answers
31k views

Active Directory: delete vs. disable departed employees [closed]

When an employee leaves your organization, do you delete or disable their Active Directory account? Our SOP is to disable, export/purge the Exchange mailbox, and then after "some time" has elapsed ...
26
votes
5answers
3k views

How can I prevent accidentally jacking with a production database?

Just recently, I had a developer accidentally try to restore a database to production, when he should have been restoring to a staging copy. It's easy to do, given that the db names are similar, i.e., ...
19
votes
6answers
2k views

Bad to be logged in as admin all the time?

At the office where I work, three of the other members of the IT staff are logged into their computers all the time with accounts that are members of the domain administrators group. I have serious ...
17
votes
8answers
902 views

What is the system administration equivalent to dogfooding?

Software developers have the concept of "dogfooding", which is where they personally use the software that they are developing, often on a regular basis. For some projects, the direct interaction it ...
17
votes
1answer
1k views

How to correctly move a server inside a rack up and down

Maybe a bit stupid question, but Sometimes (rarely but it happens) I need to move a server in a rack 1-2U up or down. What do you think, which of the ways is the most correct and useful and why? ...
17
votes
4answers
2k views

Where do companies typically store SSL certificates for future use?

We recently bought a wildcard SSL cert for our domain. We converted all of the certs to a Java keystore, but now we are asking ourselves where we should store these for later use. Do people use ...
16
votes
8answers
1k views

Best practices for backup checking?

It is a common situation, when administrator makes system for automatic backuping and forgets it. Only after a system fails administrator notices, that backup system has broken before or backups are ...
16
votes
3answers
5k views

Naming a new Active Directory forest - why is split-horizon DNS not recommended?

Hopefully, we all know what the recommendations for naming an Active Directory forest are, and they're pretty simple. Namely, it can be summed up in a single sentence. Use a subdomain of an ...
13
votes
4answers
38k views

Best Practice: vCPUs per physical core

I am trying to find some documentation or best practice guides for virtualization with respect to provisioning vCPUs per physical core (of a CPU). If it matters, I am looking at vmWare for the ...
13
votes
4answers
5k views

In Puppet, how would I secure a password variable (in this case a MySQL password)?

I am using Puppet to provision MySQL with a parameterised class: class mysql::server( $password ) { package { 'mysql-server': ensure => installed } package { 'mysql': ensure => ...
12
votes
5answers
18k views

A secure, standard iptables rule-set for a basic HTTP(s) webserver

I have been trying to put together a basic server iptables script that will work for most sites just running a basic webserver using HTTP(S) and SSH (ports 80, 443, & 22). After all, most VPS only ...
11
votes
2answers
10k views

What Are The Best Practices For Business Folder Structure?

We've tended in the past towards having departmental folders (Sales, Marketing, etc) on a single share and then adding folders below these ad-hoc as and when they're needed. It's gotten a bit messy - ...
11
votes
2answers
412 views

Outlook Email Abuse - Guide for email etiquette?

I've spent a lot of time performing mail migrations for companies that either had very little IT focus, or no fulltime staff to handle common issues. As a result, policies governing email use and ...
11
votes
2answers
2k views

Best practices for settings for Oracle database creation

When installing an Oracle Database, what non-default settings would you normally apply (or consider applying) ? I'm not after hardware dependent setting (eg memory allocation) or file locations, but ...
10
votes
4answers
2k views

Best practice for automated Linux updates

We are working on a way to perform automatic updates for our RHEL/RHEL-based servers. Initial idea: Using Puppet, we disable the default repositories and point to our own. Then, we use ensure => ...
10
votes
5answers
621 views

Tips to gracefully take over a (UNIX) production server

After months of neglect, e-mail flames and management battles our current sysadmin was fired and handed over "the server credentials" to me. Such credentials consist in a root password and nothing ...
10
votes
3answers
604 views

Cisco ASA and multiple VLANs

I currently manage 6 Cisco ASA devices (2 pairs of 5510s and 1 pair of 5550s). They all work quite nicely and are stable so this is more of a best-practice advice question rather then "OMG it's ...
9
votes
7answers
883 views

C:\ is for OS, D:\ is for Data?

"Back in the day" we always segregated our OS drives (in Windows) from our Data drives. In the Linux world, although I am much less familiar with it, I am aware that the wisdom dictates even more ...
9
votes
1answer
478 views

What are the best practices for service accounts?

We're running several services in our company using a shared domain account. Unfortunately, the credentials for this account are widely distributed and being used frequently for both service and ...
8
votes
3answers
606 views

What are some best practices when taking over IT at a new company? [closed]

I thought this would make for a good topic with some interesting suggestions. What are the first things you would do when taking over IT at a new organization? What are some red flags you would look ...
8
votes
4answers
26k views

How do you diagnose packet loss?

I realise this is very subjective and dependent on a number of variables, but I'm wondering what steps most folks go through when they need to diagnose packet loss on a given system?
8
votes
1answer
3k views

Server room wiring questions

I'm looking at rewiring our server room to be more presentable, organized, and easier to troubleshooting. Right now we currently have 4 HP racks (don't know the model right now). We do not have a ...
8
votes
1answer
911 views

Best practice for Exchange 2010 HA topology considering 6 x Exchange licenses and TMG 2010

What would be best topology considering that: 6 x Exchange 2010 Standard Licenses 2 x Separate locations that are supposed to support redundancy in case of link problems 4 x Forefront TMG 2010 with ...
8
votes
1answer
847 views

How to manage Nagios dependencies on big clusters?

I'm using quite a big nagios configuration (about 4000 services), without any dependencies. This results in a huge mess of notifications when something goes wrong. I try to look for best practices ...
7
votes
5answers
3k views

Nagios server best practices?

I run a medium-sized Nagios server. It monitors roughly 40 servers with 180 services currently and is only growing by the day. I migrated from an old Nagios setup that was configured in a very ...
7
votes
2answers
334 views

Transition away from Domain Admin only account

In our Windows environment, our Domain Admins only have one user account. This single user account is used across the board including running on a day to day workstation. In our transition away from ...
7
votes
2answers
600 views

As an admin, what tools do you use to log what you do to your boxes? [closed]

I am more of a linux applications developer than an admin. Over time, I've built servers and maintained them, sometimes to offer services, mostly just to develop the applications I work on. Way back ...
7
votes
6answers
7k views

Daily/Weekly/Monthly/Annual Sysadmin Tasks

This should probably be community wiki. I'm trying to come up with a list of all the sysadmin tasks that we should be doing on a regular basis because I believe we're not doing enough at our company. ...
7
votes
3answers
744 views

How can I load-balance a load balancer?

I'm about to convert a single-server single-database web application into a physically distributed high-available configuration with servers on two physical locations (for now). Now, obviously, I need ...
7
votes
2answers
4k views

Best strategy to keep chef cookbooks versions under control

I'm looking for ideas about chef cookbooks versions management. I know that you pin specific versions in the environment, but I'm not sure how to go about it. We use librarian-chef which installs 3rd ...
7
votes
2answers
2k views

GPO best practices : Security-Group Filtering Versus OU

Good afternoon everyone, I'm quite new to Active Directory stuff. After upgraded Functional level of our AD from 2003 to 2008 R2 (I need it to put fine-grained password policy), I then start to ...
6
votes
8answers
1k views

System administration standard [closed]

I have been given the responsibility to manage a team of 4 system admins. They are managing 70+ servers. They don't yet have written processes/procedures/practices. I don't much about system ...
6
votes
3answers
308 views

Is there already a recommended IPv6 Firewall setup?

I'd like to switch from private-IPv4-subnet-behind-NAT to IPv6, but of course I have no intention of exposing my users' workstations "unprotected" to the net. Some obvious points up-front: Allow ...
6
votes
4answers
460 views

powershell vs GPO for installation, configuration, maintenance

My question is about using powershell scripts to install, configure, update and maintain Windows 7 Pro/Ent workstations in a 2008R2 domain, versus using GPO/ADMX/msi. Here's the situation: Because ...
6
votes
4answers
517 views

Is it better to map drives and printers to users or computers?

I've posted a few "best practices" questions like this. Question says it all. Current practice is to map the drives and install the printers on the computer for each user/computer combination. I'd ...
6
votes
1answer
107 views

When should an org invest in a private infrastructure as opposed to a partially or fully hosted solution? [duplicate]

Not referring to militaries or governments, but for other organizations or shops that needs an IT infrastructure (who doesn't nowadays). Similar to this question, but purely in regard to hardware ...
6
votes
2answers
457 views

Tool(s) for labeling cables with unique ID numbers

We are looking to (finally) implement a cable labeling procedure. We already have a labler. Now we need a system to maintain unique IDs not related to anything. I thought of getting a tally counter ...
5
votes
7answers
3k views

Network Drive Letter Assignment Best Practices

We are working on migrating from Novell to Active Directory. During the transition, We are going to evaluate our drive mappings in light of current standards to see if what we have been doing still ...
5
votes
4answers
1k views

dead man's switch for remote networking interventions on Linux

As I'm going to change the network configuration of a remote server, I was thinking of some security mechanisms to protect me from accidentally losing control on the server. The level-0 protection ...
5
votes
2answers
1k views

Best practices for file layout in a Hyper-V server?

We've got a Hyper-V server set up, and the layout of the files is inconsistent because it was set up by several people. Here are the two different "templates" that were used: Template 1 ...
5
votes
2answers
228 views

Best practice advise asked when users want to work on their workstation and from remote (but on their desktop), on Windows

I've got a work-group of 5 people. All of them have their dedicated machine with Windows 7. They are all connected to a central server running Windows Server 2008 R2, currently mainly offering the ...
5
votes
2answers
165 views

Why should www.domain and mail.domain be used?

I see the default hostname for mail and web servers being set as mail.domain.tld and www.domain.tld respectively. Why is this? Does it help as you move from a single server to multiple servers? I ...