Link to home
Create AccountLog in
Avatar of patriots
patriots

asked on

Single domain or multiple domain for a school or university???

We are a small southern college.  We are in the midst of an Active Directory design.  The question that has been posed to the design team is whether or not we should maintain a single Active Directory domain for all students, faculty and Staff, or should we maintain separate domains...namely, one for students (several thousand) and one for faculty and staff (about a thousand).

Our contention is that a single domain should be fine.  We'd really prefer this as an Exchange system is also being implemented and we'd prefer a single Exchange organization, rather than multiple.  Additionally, we believe students can easily be maintained in a separate OU, and adequate security measures and GPO's can be employed to maintain security.

Personally, it appears to me, that the practice of deploying a separate AD domain in such circumstances is less prevalent than it once was, mainly b/c the feeling is that both security and manageability can be satisfied by deploying a single directory.

I was hoping for feedback.  Especially anyone who is currently or has worked for a college who at one time or another had to do the same thing.  Are there any big minuses from our thoughts on this matter?  Any thing we should keep in mind?

Thank you.
Avatar of James Haywood
James Haywood
Flag of United Kingdom of Great Britain and Northern Ireland image

I would go with the single domain. The only possible reason you might want separate domains is for DR as if there is an issue with your AD and you have a single domain then the problem will affect pretty much everyone and every machine. Saying that, if you have plenty of redundancy and a decent IT team then you should be able to deal with these problems without much issue.

A good AD layout using thought-out OUs and GPOs will give you huge amounts of control and delegation options. If you have more than one site (like most colleges/Unis) then you can use the AD sites and services rather than child domains.

Avatar of Darius Ghassem
You can go either way but if you are managing these three groups from one Admin or Tech suppory group  then I would recommend going with Single domain with multiple OUs this will allow for easier administration.

https://www.experts-exchange.com/questions/22803733/Single-Forest-Single-Domain-versus-Single-Domain-Multiple-OU-design-guidelines.html
Avatar of mickinoz2005
mickinoz2005

as the others say with the level of control you can have with OU's and GPO's it would not make sense to split them.
Having just finished an AD/Exchange migration and redesign for a large college (over 20,000 students plus faculty), we consolidated 3 AD domain and 2 Exchange organizations down to a single AD domain and single Exchange organization.  It just took good planning and organization before hand to lay out the project and complete it.  The administrative overhead from supporting multiple AD domains and Exchange organizations was killing the support staff.  After all was said and done, the simplicity of the "new" centralized infrastructure allowed technicians to start working normal hours and saved dollars spent on overtime and supporting too many disparate systems.
ASKER CERTIFIED SOLUTION
Avatar of tigermatt
tigermatt
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
I agree a single domain has its benifits.

So, maybe we should be providing alternatives and a different form of security. Have you considered a single domain split via VLANS?

ADMIN VLAN, User VLAN, Wireless VLAN, STAFF VLAN, etc...

VLANS allow you to control what ports are accessible by other VLANS if configured right.

You can always count on students hacking into the system.
Can I ask what is more difficult about managing two different domains? Say 1 forest and multiple child-domains?