I have one machine (Dell T320 Intel Xeon CPU E5-2401 @ 2.4GHz w/ 32GB Ram). I'm running Windows Server 2012R2. I have a total of 5 users.

I need to run AD, DNS, File and Storage Services, and Print Services roles. I also need to host Symantec Endpoint Manager and WSUS.

I've been reading a lot, and there seem to be many opinions out there, but I am trying to figure out the best way to deploy this server with the multiple roles it needs.

I'm reading that the best way to do it is have just the Hyper-V role on the host server, and then have one VM with AD, DNS, File and Storage Services and Print Services roles, and then another VM with the WSUS and Symantec Endpoint Manager.

I don't really like the idea of running WSUS and Symantec Endpoint Manager on the same VM, but I am limited to two VMs with Server 2012R2 Standard.

Does this configuration sound good? Should I run the Symantec Endpoint manager on the host machine instead of a VM with WSUS?

Can anyone suggest what they would do with these requirements given the hardware and software that I have?


  • I don't really like the idea of running WSUS and Symantec Endpoint Manager on the same VM. - Why not? – joeqwerty Sep 17 '15 at 23:07
  • I just thought you were supposed to only have one application per VM. Other than that, no reason. – Matt Sep 17 '15 at 23:18
  • In the same way you "should" have more than one DC, DNS server, a redundant host ... etc. etc. ad infinitum. If you wanted more VMs you could buy another Server Standard license for the same host - but for 5 users, one physical host, you get only a little benefit from splitting things onto separate VMs, and it's almost all a management benefit - separation of concerns, limit of risk from changes - rather than anything else. I'm wondering if you even benefit from Hyper-V. What kind of backup system do you have? – TessellatingHeckler Sep 17 '15 at 23:22
  • Hi Heckler: I see what you are saying. Currently, I back up the server I am replacing by backing up the system state and the files to a NAS, and to a cloud service. – Matt Sep 18 '15 at 0:02

I've been reading a lot, and there seem to be many opinions out there,

Indeed, and that's all you'll get from me as well, I'm afraid. But you have one server - either it's powerful enough to run all the tasks, or it isn't. Splitting them onto several VMs won't change that part.

So what do you gain/lose by splitting the roles over two VMs?

  • Changing/patching one program will be less likely to affect anything in the other VM
  • Rebooting can be done without taking all services offline at the same time
  • Software is less likely to clash, e.g. two programs wanting to listen on port 443.
  • There's more processor, memory, disk, backup overhead from running two VMs, having two Windows installs.
  • If you have two VMs you have the opportunity to use VLANs and separate one off with different network access.

I don't know Symantec Endpoint Manager, but the other roles are all very good at sharing a Windows install - they did it on Windows Small Business Server for years.

Can anyone suggest what they would do with these requirements given the hardware and software that I have?

You've gone straight for Hyper-V instead of considering running everything on the server directly. There's something to be said for just using Windows on the physical server, especially if you aren't familiar with virtualisation. It would be an overall simpler setup. Will you be maintaining it or is someone else? And are they familiar with Hyper-V, or are they an ordinary employee who gets stuck with the computer tasks they aren't really interested in?

I would use virtualisation because it makes reboots quicker, and you should be patching and rebooting regularly enough for that to be a big benefit alone. Backups and restores should be more easier with hardware abstraction, and it gives you more flexibility for moving guests between hosts or moving disk/CPU/memory resources between guests in future.

I would run everything you mentioned on one VM, and either keep the other VM license for future expansion, or use it as a second DC and DNS server to make rebooting and maintenance less intrusive - so workstations can still logon, resolve names and get to the internet, external email, etc. while one server is rebooting (or broken and being fixed).

  • Wow! Thanks everyone so much for the very helpful comments! – Matt Sep 18 '15 at 14:12
  • You are correct, the server needs rebooting often due to updates, and it takes awhile to do so. I'm leaning towards creating a VM to house AD, DNS, Fileserver, and Printserver. I can then use the other VM for apps (SEPM, WSUS etc). The main reason I think this is a good idea is that it makes for easy DR. If something goes wrong, I can just rebuild a standard 2012 machine, and the load a backup of the VMs and I'm up and running. I'm wondering how I should configure my two network cards. Teaming them, or using one for the host and one for the VMs. Any ideas? – Matt Sep 18 '15 at 14:22
  • That's also reasonable. I probably wouldn't team them, unless the 5 users were doing something very network intensive all together; disk IO at both ends is more likely the limiting factor. That said, there isn't much in it either way - if you team them and don't like it, it's only a few minutes to change it. – TessellatingHeckler Sep 18 '15 at 15:19
  • @Matt I saw your earlier comment; the only reason I would discourage virtualisation is if you've never used it before and would be learning on a production deployment, because you don't want to revert a snapshot and be surprised at the data loss, leave a snapshot until the disk is full and you have no space to delete it, expand a virtual disk and then find out you can't shrink it, etc. But if you're reasonably comfortable with virtual machines (e.g. Parallels), it is so much more flexible that it's worth it. And it's pretty well established, widely supported and stable. – TessellatingHeckler Sep 18 '15 at 21:45
  • I don't have a lot of experience with virtualization, but I'm familiar enough with it to not worry too much about the things you've mentioned. It's a really simple deployment. Thanks again for your input. – Matt Sep 21 '15 at 16:13

I just thought you were supposed to only have one application per VM

While there are certainly some applications, services and roles, like Exchange Server, that should run on dedicated machines (whether virtual or physical), that's not to say that all applications, services and roles should be run in their own silo.

That being said, I don't see anything inherently wrong with running WSUS and SEPM on the same VM. Neither one is particularly resource intensive. One definite advantage to virtualization is that you can, if necessary, quite easily scale up if it turns out that either of those roles needs more resources. Adding CPU, Memory and Disk resources to a virtual machine is, in most cases, a fairly trivial matter.

Additionally, with Windows Server 2012 R2 Standard Edition you are licensed for two Windows Server based virtual machines (of the same version and edition), you are not limited to two Windows Server based virtual machines. You can run more than two Windows Server based virtual machines but any beyond two need to be licensed individually.

Let me add this to address some of your comments to the answers provided:

It took me a long time to get on board with virtualization. Now that I am onboard with it I find very little value in or justification for "single use" physical servers these days. Even if you are planning on running multiple applications, services and roles on a single server, you can still benefit from virtualization in improved efficiencies, scalability, manageability, availability, portability, etc., etc. If you can confidently say that the applications, services and roles you've outlined in your question are all you're ever going to need and that this single physical server running all of those will do the job then by all means go for it, but I think that's being shortsighted. What happens when you decide that you need two Domain Controllers so that you're inline with Active Directory best practice (you really should deploy two Domain Controllers), or you acquire another Line of Business Application, or another SQL Server, or Exchange Server, etc., etc.? Are you going to purchase another physical server? How well is that going to scale every time you need to add a component to your infrastructure?

  • Hi Joe, I get what you are saying, and I agree. I'm working on setting up the environment now. I'm documenting recovery steps as I go. Once I get everything set up and working (including backups and snapshots), I'm going to tear it all down as if a catastrophic failure has occured, and then use my notes to put it all back together again, and update my notes. This way, I can be confident that I can restore everything if needed. – Matt Sep 23 '15 at 19:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.