3

At the moment, we have 1 machine running IIS, SQL server, Active Directory, some kind of Quickbooks service..., DHCP, DNS, and VPN server. It's... precarious. There are about 10 people inside the office, and 30 that hit the web server once in a while. I'm trying to get 2 more boxes, or at least one more, to split this stuff out onto.

I'm thinking something like:

    1. Web/App stuff
    1. AD-1, DNS
    1. AD-2

Where does DHCP go? I've been reading through all the Active Directory questions here and, some places say, DHCP on AD machine is bad security idea while others talk about all the benefits of AD,DNS, and DHCP talking to each other (on the same machine).

VPN?

Improve this question
3
  • Are any of these services going to be accessed from public (ie. the internet)?
    – Mathias R. Jessen
    Feb 18, 2012 at 1:19
  • 2
    Any server that is running AD should always run DNS as well; I have never heard a good reason for not doing so.
    – Chris S
    Feb 18, 2012 at 3:14
  • @MathiasR.Jessen Just one IIS site and the VPN of course. There's also sharepoint running, which I had forgot about because no one uses it; We are on google apps. I should turn that off.
    – tladuke
    Feb 18, 2012 at 6:09

1 Answer 1

Reset to default
4

Running DHCP on a DC is not reccomended, but the risk is lower if you follow these steps http://support.microsoft.com/kb/255134

I actually do this same thing, even thought my DHCP isn't running on a DC.

I think your setup is fine, except I would make the following minor tweaks.

  1. Web/App (as you mentioned
  2. AD, DNS/WINS, DHCP
  3. AD, DNS/WINS, DHCP

one thought, if you could splurge on some enterprise licenses instead of standard (i assume that's what you're running), you could run up to 4 VM's per physical socket, which would give you a lot more flexability. Even if you could run just one physical server as a hyper-v host, that would net you an ability to seperate our your VPN from your other stuff.

Improve this answer
2
  • Just be sure to split the DHCP so that you don't have both servers issuing the same addresses.
    – John Gardeniers
    Feb 18, 2012 at 11:02
  • Indeed, since we have plenty of IP sapce, we set the scope so that its large enough that any one DHCP server can handle the full load without needing to adjust exclusion ranges. Example, we only need 254 addresses, so we use a /23 subnet (512 addresses) and exclude 254 on each DHCP server. Of course not everyone has that luxury.
    – Eric C. Singer
    Feb 18, 2012 at 15:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .