Solved

Best practices Design Active directory

Posted on 2014-10-16
7
160 Views
Last Modified: 2014-10-17
Hello gents

i have a question I want to redesign an Active directory ? but there is something that I'm not certain of : Actually I have 2 networks : 192.168 . 6. X where there is One domain Controller and A second Network of 192.168.7.X where there is a Second Domain controller  (Domain is the same). I have Servers that are seating in the two domains.

I want to create a domain for the servers only . Is it a recommended practice?  I want to create a VLAN dedicated to servers .  any Impact on Active directory ?

Rgds
0
Comment
Question by:gazambey
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 8

Expert Comment

by:Wilder_Admin
ID: 40383831
You are mixing topics. First to make all clear. AD is more or less for authenticating users and computers so easily to say a trustcenter then you have the topic of network. You have to network as a subnetting setup for locations maybe. And you have VLAN is a accessingcontrol for networks.

All are depending on each other but here does it not make sense to create a new domain.

What you can do instead ist to bring the servers in a own subnet / Vlan and clients etc in a different one. This is depending if you have two locations (cities?) and how they are connected. For VLAN you need special hardware and a way to manage them. Its one to setup and one to manage them. I hope i made it more clear???

At the end you need a concept what you want and how you achieve. In both i can help if you need.
0
 
LVL 82

Expert Comment

by:David Johnson, CD, MVP
ID: 40383898
With a VLAN separating clients and servers brings another question .. how does a client access a server?
0
 

Author Comment

by:gazambey
ID: 40383962
Hello People

I appreciate your comments. first of all I'm not mixing Subjects . I know that AD is for Authentication . My question is is it a good practice to have a VLAN for Servers and another One for Computers?

And sorry I don't want to create a new domain . I wanted to say a new network.
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 
LVL 14

Expert Comment

by:Andy M
ID: 40384021
If you have a separate network for the domain controllers the computers would still need access to that network to authenticate/access files/etc.

I think the first question is what are the reasons for separating out the server/computers - unless there's a specific reason to do so I don't see any reason to separate the servers to another network.
0
 
LVL 8

Expert Comment

by:Wilder_Admin
ID: 40384214
You are not seperating Servers from clients with vlan the best practise if you can is to group clients with servers. For example your accounting has a own Terminalserver where alle financial Software is installed on. So it would make sense to seperate them from the rest of the network except of the dc.

Thats the way for vlans. What you can do is the subnetting topic to collect all clients in one and the servers in the other. Thats only cosmetic. It can make sense for example when your dhcp scope is getting to small then it would be a good idea to seperate the clients.

Even think about of ipv6 in your internal network? I know its the future and no need yet but if you want to be the first then its time to do.
0
 
LVL 10

Expert Comment

by:Pramod Ubhe
ID: 40384225
recommended practice is that you should have separate vlans for desktops and servers but those should communicate with each other. In AD you can create separate sites based on your subnets/location or map both the subnets to be authenticated within single site.
I think in your current setup you have separate domains which can easily be  done with sites and services or subnets in AD
0
 
LVL 35

Accepted Solution

by:
Seth Simmons earned 500 total points
ID: 40384241
i can see separating the networks through vlans like that in a large environment but if it isn't too large i would keep it simple and use one network; perhaps using 192.168.6.0/16 which will give you 512 addresses and will still allow you to separate into the .6 and .7 for servers and clients.  unless they are in different physical locations, i would keep both subnets in the same AD site
0

Featured Post

Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I had a question today where the user wanted to know how to delete an SSL Certificate, so I thought that I would quickly add this How to! Article for your reference. WHY WOULD YOU WANT TO DELETE A CERTIFICATE? 1. If an incorrect certificate was …
Redirected folders in a windows domain can be quite useful for a number of reasons, one of them being that with redirected application data, you can give users more seamless experience when logging into different workstations.  For example, if a use…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Suggested Courses

630 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question