Win 3

Reply 1 needed

When migrating from Windows Server 2008 to Windows Server 2012, the system requirements remain unchanged. Some features such as virtual domain controller cloning require that the PDC emulator run Windows Server 2012 and a computer running Windows Server 2012 with the Hyper-V role installed. Here are some big issues to keep in mind when installing AD DS:

· Installation of an additional domain controller using smart card credentials fails if the target server is not joined to the domain before installation.

· The ADDSDeployment module does not run under 32-bit processes

As per Microsoft (2014) the bullets below are best practices for new forest deployments:

· Each domain should have at least two functioning writeable domain controllers to provide fault tolerance. If a domain has only one domain controller and this domain controller fails, users will not be able to log on to the domain or access any resources in the domain. And if you have only one writable domain controller in your domain and this domain controller fails, you won’t be able to perform any AD DS management tasks.

· Each domain in each location should also have a sufficient number of domain controllers to service the needs of users for logging on and accessing network resources. The TechNet sections described in the earlier “More Info” topic include some recommendations on how to determine the number of domain controllers you need based on their hardware configuration and the number of users at the location.

· Domain controllers should be dedicated servers that are used only for hosting the AD DS and DNS Server roles. Their full attention should be directed to performing their main job, which is authenticating users and computers for client logons and for accessing network resources.

· The simplest forest design has one domain. The more domains you have, the more administrative overhead you will experience managing multiple service administrator groups, maintaining consistency among Group Policy settings that are common to different domains, maintaining consistency among access control and auditing settings that are common to different domains, and so on.

· If your organization has multiple sites, such as a head office and one or more remote branch offices, you should generally deploy at least one domain controller at each remote office to provide users with faster logon times and more efficient access to network resources. For best security, domain controllers at remote offices should be RODCs.

For existing forest deployments, Microsoft recommends the following:

· Deploying new Windows Server 2012 or Windows Server 2012 R2 domain controllers in an existing forest whose domain controllers are running an earlier version of Windows Server

· Upgrading domain controllers running earlier versions of Windows Server to Windows Server 2012 or Windows Server 2012 R2

References

Microsoft. (2013). What's New in Active Directory Domain Services Installation and Removal. Retrieved from

                  https://technet.microsoft.com/en-us/library/hh472161(v=ws.11).aspx#BKMK_SystemReqs

Reply 2 needed

When deploying directory services it is a good practice to dedicate a specific domain controller and keep them clean, meaning don’t overload them with other services like using them for other duties such as a file server or mail server. Overloading domain controllers can decrease the performance of the server and pose a bigger security risk. Having multiple domain controllers through the use of virtualization to create fault tolerance is another good practice. Keeping the design simple and organize is another good practice for easy management and efficiency. Such as having one forest to allow two way trust between the trees, and creating domain structure to match the organization geographic structure.

Reference:

Posey, B. (2013). Simplicity Is Key when Deploying Active Directory. Retrieved from: https://redmondmag.com/articles/2013/01/01/active-directory-your- way.aspx?m=2

Posey, B. (2010) 10 Tips for effective Active Directory Design Retrieved from: http://www.techrepublic.com/blog/10-things/10-tips-for-effective-active- directory-design/