Active Directory Design for Live and Development Environments
Posted on 2013-10-23
I'm seeking advice on the design of a small Win2K8 network with some specific requirements.
I need to establish a development network that mirrors a live production network. Requirements are:
1. The machines in the dev segment must use the same computer names as their live counterpart. (server1.live.local and server1.dev.local is fine)
2. Administration needs to be centralized - one set of user accounts to access both networks (RSA keys are used). I also want one centralized way to back up the servers, push updates and virus signatures to both networks.
3. Systems in the live and dev networks should not see each other.
4. Both networks need to be on the same IP subnet (VLANS can be used). There is a gateway machine on this subnet that connects directly to the client for data delivery.
I believe what I want to do is create an AD forest, comprised of one parent domain for user accounts/administration, etc and two sub domains for the live and dev networks. (sort of a hub and spoke config).
I'm not sure how to accomplish this - does each domain require it's own domain controller or can the live and dev subnets just use RODC's of the parent? Is there a problem having machines with the same name in this config? How do I establish trusts so that the parent can see the subs but the subs don't see each other? Can these networks reside on the same IP subnet?
I welcome your suggestions.