help Design Active Dir. for company with 4 offices

M

mehargags

Adept
Hi all,

I couldn't spot any other place to post this so pardon if this is the wrong section. This thread is to discuss opinions about a solution i need to design for the client...

If there are any MS Server / Exchange Admins onboard on TE, I seek your opinion & consultation.

I Need help designing Active Directory for a client who has 4 branch offices and one head office. The 4 sites have user email IDs in Same primary domain as well as 2-3 more domains, which are sister concern companies for the Primary company.

Biggest question : Should I use SBS or use 2008 R2? or regular 2008 R2

If I close down to single forest/domain, I want ideas on how to create my FIRST server. what I plan is:

Primary domain: company.com

Other regd. company domains: companyLABS.com, companyTECH.com

4 sites have people working for all 3 domains stated above. So I plan to make 4 sites:

site1.company.com
site2.company.com
site3.company.com
site4.company.com

All above 4 sites will be part of one major AD: company.local (company.com). This AD server will be at a 5th location where the IT manager will have physical access to this Primary AD server, she'd be controlling all policies from this which will be in affect on other 4 sites...

Please shed some more light on the plan...

Also I do plan to use Exchange for emails.. but later... once all data is centrally managed, practised and adapted by the underlying users at all 4 sites. There are a total of 5 email domains that will be required....

The client currently is not using any collaboration tools like sharepoint etc. They don't even have client server architecture at the moment.. all computers at different sites operate in a hay-way workgroup mode. No centralization at all.. That is the concern for the stakeholders, as the company has grown more than 5 folds in past 5 years, they are a pharma company who is into
1. Manufacturing medicine -Labs and Pharma plant (primary domain)
2. Research in Bio technology
3. IT arm of this company making ERPs for pharma companies. They develop & sell customised Software to many small and medium pharma companies (small team of 15 people)

As stated, I'm to start from scratch for them, so instead of rushing to put up a server there, I want to dedicate time in planning...

At the moment, we need to start with first H.O. with around 25-30 people. I need to put a first server there, configure "AD for this site only", configure folder redir for users and if possible create exchange for them too!! Then give this a test run for a month or so. This AD can be remotely managed by the IT Manager and "me"

Likewise once the stake holder's are satisfied, we move to second site, do the same, put a server there, centralise data adn move to third and 4th site

Once all 4 sites have 4 Servers (4 ADs) setup and running separately, the IT manager, who heads the ERP development team and sits at the 5th Site, will get a NEW Server, which will be configured to be as the SUPER AD. all 4 previous servers will connect to this one server for AD backup (data backup will be treated seprately per site) and will impose policies to underlying 4 servers as set on the SUPER AD.

my explaination above my not adhere to how AD actually works, but thats how the flow of action needs to be with the client. SO I seek some pointers on how to design EACH SERVER individually for each site, so that later when all 4 sites have servers, we can create trusts between them, or join all of them to a SUPER AD to get their policies etc..

I hope I was more clear on the scenario, thanks for reading up...
My main dilemma is should I put 4 SBS servers at each site or should I make them as regular ADs in a single forest. cost is concern to the company.. so help me decide

Regards...
 
The AD scenario you mentioned is a bit complex, and you need to consult with a AD Designer for this, if you are not one (which I am assuming or else you would not ask this question in a public forum) Also designing an AD infra requires lots of inputs and what not, how far are the site, are they linked to each other, what is the bandwidth between them and so on so forth.

Regarding Exchange, if you are not a Email Server admin and you require to send emails out (as in to external email addresses like yahoo.com and gmail.com) you need to do lots of hardening and will probably require an antispam gateway, firewall and what not. Again consult a AD Designer / Exchange deployment person.

Do not opt for SBS coz if I recall there is a limitation on how many users can be provisioned. If you are above that number then you will have to use Exchange Server on Windows 2008 not SBS.
 
First thing first, You need to think about Unique Identity System before you even touch the SUB Domain part of it.

Why, well simple. even if you end up designing the main Domain and then Sub Domain (Which is fairly simple in AD System and readily available as an option), you will end up in a confusion of, who gets the permission and where.

If the permission are as simple as 'Copy from Parent' then it is a piece of cake, however if you have a complex system (Say User of D1 also gets rights on D2 But is restricted in D3) then you will have to manually configure the rights from the designated OUs.

Now the eMails, yes you can have multiple email account respective to sub-domains and can set it up on either the user's Outlook or exchange server to route the emails to one single account.

As far as completely designing the solution, it comes with a cost. Besides, not everyone would like to messup with that environment, rather everyone would suggest you that design it from scratch. this will help you with the following.

Simple solution for AD & Exchange Structure.

Future upgrades will be much simpler and the company wil not be dependent on a particular resource.

Incorporating new technology and virtualizing the platform will be much simpler.

Low cost of maintenance and implementation.

Easy configuration with Share Point & Document Center Library Systems.

Unique ID will help you with easy configuration of permissions for every user in a definite OU.

think about it and discuss with the client. And Remember

It is Duty of an IT Employee to serve simple solutions and bring efficiency in the environment. If you fail to make the client understand the simplicity then its better not to get your hands into it.
 
Windows 2008R2 has lot of advancement in terms of forest level trust compared to SBS which has lot of limitations.

You can go with windows 2008 r2 standard edition also, I am using it only my 35servers with Hyper-V, infact you can also initiate CA for multiple forest level trust.

Setting up active directory is very simple but yes it requires good future planning as then you can resolve issues faster if you have better planned domain.

For Ho keep the forest separate for branch offices you can use child domain or you separate forest can also form trust.

BTW there is nothing as super AD, atleast I have not heard in my 12yrs experience, it is a forest domain controller which is the primary domain controller hence is authorized to push GP.

Don't used SBS for 4 separate site, rather use win2k8 r2 standard separate with either single forest and 3 child domain or 4 separate forest (Not advisable) but can be alternate.

SBS comes with exchange and other stuff which is not required if setting up ADS is the objective.

Regards

Shahbaaz
 
Back
Top