Why to NOT install terminal server on existing DC and Exchange Server

PLease read below.  I need the "smoking gun"r eason not put put Terminal server on DC01.  They are insisting I do it, I of course want to do the right thing and sell a new server to them for Terminal Server.  Please comment and help a brother out.


Frank/Simon/Wilson,
 
Wilson,  After speaking with you this morning, I should have asked you a question, as the information below is predicated on it.  Have you attempted to install the Oracle application in LAX locally on these PCs?   Have you determined that there is a performance issue?  As you are aware, this is a VPN connection, and the limiting performance factor is the speed of the connection.  This is a 10Mbps/1Mbps Down/Up circuit.
 
Wilson,
 
Please call me any time after 7AM EST (GMT -05:00) on my cell phone at 973-896-4951 to discuss anything as indicated below.
 
After discussions with you this morning, Earl, Jim and I spoke at length about adding terminal services to your current server infrastructure at M&M.  Currently M&M has two servers.  DC01 and DC02
 
DC01 has the following services running
 
"         DC
"         DNS
"         DHCP
"         FSMO Roles
"         Symantec Console
"         Exchange
"         File and Print
"         POP Beamer
"         Antigen
"         Default Server
"         Backup Exec 10d
"         UPS Manager
 
DC02 is the Oracle database server and we have been instructed to not touch it
 
I am not recommending adding any further load to the DC01 at this time.  I fear that the existing services will come to a crawl and/or you will be putting too many eggs in one basket.  Also Microsoft Exchange and Microsoft Office should not be on the same machine.  If you application has any hook to office or MAPI, it will be an issue.
 
Id rather see M&M get a new server, and run Terminal Services stand alone.
jcistaroAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Cláudio RodriguesFounder and CEOCommented:
Many reasons for not doing this:
1. As you pointed out, Microsoft Office does not like Microsoft Exchange when they are both on the same box for many reasons (certain DLLs will get overwritten and troubles will come from that).
2. Security: to logon to the domain controller locally you will need to 'relax' security at the DC level what will open doors for users doing things they are not supposed to to on this DC and possibly on the second one that runs Oracle.
3. Performance: with all these other services running, TS performance will suffer.
4. All eggs in one basket: Microsoft taught us a lesson over the years that when you patch something you may break something else. This means if this machine becomes a TS and a critical patch is released to fix the TS portion, you may break something else like Active Directory, Exchange, etc. So terrible idea.

Resuming, terrible idea and highly not recommended.


Claudio Rodrigues

Microsoft MVP
Windows Server - Terminal Services

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
LauraEHunterMVPCommented:
Configuring a DC as a Terminal Server requires you to grant "Log on locally" permissions on your domain controller to any user who needs to use the TS service.  The escalation of privilege attack whereby a user with log on locally on a DC can elevate their own privileges to that of a Domain Admin is well-known, published, and trivial.

If you make your DC a Terminal Server, then you have effectively made every Terminal Server user in your organization a Domain Admin.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Server OS

From novice to tech pro — start learning today.