Windows Server Proposal Paper

Windows Server Deployment Proposal For

Worldwide Advertising, Inc.

Proposed By: Jermaine Nicholson

10/20/15

This Windows Server Deployment Proposal will include potential network infrastructure solutions that will accommodate all factors needed for the establishment of Worldwide Advertising, Inc to have a strong infrastructure. This proposal will provide the details that will go into account for the implementation and configuration of the Windows 2012 Servers along with the roles and features that these server will provide so that the network infrastructure meets the needs for WAI now and take in consideration for company growth for the next 2-3 years. The proposal will also include the technical reasons for the choices we’re presenting, as well as the business reasons so you can take into account the cost of implementing these proposed solutions.

We took into account that WAI will begin with roughly 90 employees and we assume that the company will continue to roughly 150-200 employees over the next 2-3 years. So this proposal will be tailored towards this assumption. We are also taking into account the two locations, Los Angeles (being the Headquarters) and New York (being the branch office). We are proposing that we introduce 4 servers, with all four hosting the Windows Server 2012 R2 Datacenter edition, to be deployed across these two locations. Two servers will be located at the Headquarters in Los Angeles and the other two will be deployed in the New York office.

The two servers at the Los Angeles location will be the main servers used for the core I.T network services, such as DHCP, DNS, Active Directory, and File Server (these services will all be explained later in this proposal). One of the two servers at both locations will solely be used as a backup server for fault tolerance, in case the main server goes down for whatever reason. The backup server will be configured the same way as the primary server would with all of the roles and features as the primary, but will only be used in the event of an outage to the primary server.

The deployment method of these servers would be to manually build the primary server from scratch at the Headquarters, then we will used a script from the primary to automate the deployment process of the backup server. This way we know for sure that the both servers at the Headquarters will both be configured in a uniform manner. We will also manually deploy the primary branch server since they will host different roles and features than the HQ servers, then use a script to deploy the backup. The branch servers will be configured with Server core as a security measure, it minimizes the risk of potential hackers trying to find loopholes in the branch sites networks.

Windows Server 2012 Features

When it comes to implementing a network infrastructure from the ground-up, it takes patience and thorough configuration to make sure that no steps are missed, if not would result with major network problems down the road. This being said, Microsoft latest product Windows Server 2012 has made it so easy to configure the core services needed to build a corporate network infrastructure from the ground-up, it would be pretty difficult to miss a configuration step during the deployment process.

One amazing feature offered from Microsoft that will be implemented with this network infrastructure design will be the Hyper-V role. This feature will single handily eliminate a ton of hardware space in your server closest in addition to saving you money on purchasing additional servers to host company applications, and other network resources. With the addition of Hyper-V you can consolidate the all network resources to a single server, or two, by placing all of your network roles inside of VMs on the physical server. There’s isn’t a need to have a single server that’s only dependent on performing one task and wasting unused hardware resources (HD space, CPU, and RAM). You can now accommodate and make sure that all of these resources are being used, which again, will maximize company cost savings. Also, with the Datacenter version of Server 2012 R2, you wouldn’t have to worry about any licensing issues for virtualization, so as your company gets bigger over the next 2-3 years, you can implement multiple VMs to accommodate any new applications that could be introduced into your organization (TechNet, n.d). For the sake of the network design we will introduce 4 VMs, there will be two individual VMs that will combine the roles of DNS and Active Directory, one will be the DHCP server, and the other will be a dedicated Network File Server. In addition to this feature, Windows Server 2012 introduces Server Manager, which allows your IT staff to manage the local and remote servers from a single location, so there’s no need in having IT staff onsite in both of your site locations to manage the servers even though you stated having someone from each of your departments at your New York location, this could eliminate the possibility of having someone physically there managing the server. (Otey, 2011).

Active Directory

WAI OU Structure

We will create one domain preferably, (corp.wai.com) that will span across both sites. We assume that the WAN connection between both the L.A. and N.Y. sites will be a pretty decent speed, so we will configure both servers (Primary & Backup) at the L.A location to be a Global Catalog Domain Controllers within virtual machines, this way users at the HQ site won’t have no time delay authenticating to the domain and accessing network resources. We will configure the branch server (Primary & backup) as Read-Only Domain Controllers, reason being the small amount of people that will be located at the site. From a technical perspective it improves security, improves faster logon times and offers a more efficient way of accessing resources on the network. From a business perspective, this ensures that your staff are all able to logon to their workstations without any issues and are able to get their work completed for the day. We will also configure replication to occur on these configured virtual domain controllers, so that for whatever reason (i.e You hire new staff, fire staff, change staff to different departments, add more computers to the organization, etc) these changes within Active Directory will be consistent at both locations, so your staff that travel to N.Y and vice versa to L.A won’t have any problems logging onto the network and resources.

We also are taking into consideration the fact that certain departments want to have their data private, so we decided to consider structuring each department (Executives, Accounts/Sales, Creative/Media/Production, Human Resources/Finances, and IT) to have their own organizational units within Active Directory, as well as creating a subdirectory OU for the department’s workstations. This way we can configure the Account tab of each user to only logon to the workstations within their department:

This is the Account tab of a user in the Account_Sales OU, where they’re only allowed to logon to the Account_Sales1 computer.

With this configuration we can adjust the account tab of all user’s within the organization to only logon to the machines that are deployed in their departments, this would surely eliminate your staff from trying to login to unauthorized departmental computers. Of course we will grant the IT staff the right to login to every computer within the domain.

As another security measure for your company we will create global security groups for each department, add the user’s in each department to the global security group, then create a domain local security group & add that global security group within that. This way when we need to assign permissions to grant your staff to certain network resources, they will be either granted or denied access. This will prevent your staff from accessing files that they have no business in. We will talk more about network resources a little later, and how we will configure everyone to access what they need to see to get their job done. (Group Scope, 2014)

Users Global Security Groups Domain Local Security Groups Assign Permissions

(The structure of grouping like user’s together & assigning permissive access based on their group and what they can access.)

File Sharing

As presented earlier we will structure the security groups and add your staff to their specific department groups, we assume that there will need to access files shared on the network for collaborative purposes or even reference documentation for their job duties. So we are considering creating a file share server within a Virtual machine which will be hosted on the main company server located in Los Angeles. We will also deploy the Branch Cache role onto the server at the New York location, even though we assume that you’ll will have a fast WAN connection from L.A to New York, this will help reduce network traffic for your offsite employees connecting back to file server.

“After a client computer requests and receives content from the main office and the content is cached at the branch office, other computers at the same branch office can obtain the content locally rather than downloading the content from the content server over the WAN link.” (TechNet/Branch cache, 2014)

This would ensure that your employees have the most recent copies of files and to mitigate any issues with version control, where your staff are accessing old documents, saving the old documents and overwriting the latest ones. The flow of business will not be disrupted too much. Listed below is the file share structure for your organization. We’ve broken down the shares with three primary folders, Public Folders where your staff can save data that could benefit the organization as a whole such as training documents or other collaborative files; Departmental folder where we will create sub-folders for each department, these folders will only be accessed by the members of that department utilizing the FSRM (File Source Resource Manager) feature and enabling access-based enumeration (ABE). ABE is configured on the properties of the folder, in this case we will configure it on each departmental sub-folder, then add NTFS permissions to departmental Domain local groups to these folders, this will ensure that the user’s only see their departments share folder under the Departmental share. Another good security measure to keep your staff from accessing unauthorized files in other departments. We assume space won’t be a problem within your organization, so we won’t configure disk quotas to limit your user’s disk space, this could always be configure later down the road as your company expands and more employees are hired, you should want to limit disk usage per user. We will in fact implement File Screening, to monitor what type of files your employees are saving within their personal folders on the Private User Data share and on the Public Folders share. You don’t want to compromise your companies sensitive data with a chance a user saving a malicious executable file on the file share server, this would certainly be detrimental to the business functions of the company.

WAI File Share Structure

*Subfolders for each department

IT

Creative_Media_Production

Accounts_Sales

Executives

Share where everyone has a personal folder to save their data to on the network.

Private User Data

HR_Finances

Departmental

Folder where everyone in the company can place files to collaborate amongst themselves.

Public Folders

Application Deployment Services

With this organizational structure, it helps with the development of applying group policies, all departments would have the essential work applications deployed to them such as Microsoft Office suite, Antivirus software, Adobe Acrobat and reader, etc. We assume that each department will also be having specific applications needed that other departments don’t need. With this organizational unit structure, it surely helps with your IT staff managing and deploying these applications across the departments. The way to deploy the department specific software would be to create a package within group policy object that has the .msi file (Microsoft installer filer), and install that software to the workstation within the department that needs it. This eliminates the need to walk around with an installation disc and manually adding the software to the computers in the organization (Uhing, 2012). This greatly reduce time and effort by ensuring that all workstations in the environment have the necessary applications to perform their job roles & streamlining the business as a whole.

DHCP

For the IP address assignment to the clients and server within the organization, we have decided to configure each department with their own scope within the DHCP server. There will be 5 scopes total for all five departments. We assume that there will be growth in the future as the company expands, so we will configure these scopes to have the necessary IP address range to accommodate the companies user’s now and down the road. We understand that for the time being there will be 9 hosts within the Executive department, 15 hosts within the Account/Sales department, 49 hosts within the Creative/Media/Production department, 12 hosts within the HR & Finance department, and 5 hosts within the IT department. We will configure the scope’s address range to accommodate 3x times what the department will currently have. We will assume that the routers in the environment will be configured properly so that these devices can communicate with one another whenever they need to do so. In the table below is the potential IP addressing scheme that will be configured for the organization for the main site. The branch site server will have the DHCP role installed to deploy IP addresses to the machines located there. The private IP addressing scheme will be configured to host a maximum of 30 hosts, since there will only be about one person per department at the branch site, this is ample amount of addresses to deploy to the workstations as well as the network printers there. The network printers at both the main site and branch site will all have reserved IP addresses, this will ensure that the printers IP addresses will never change. The servers will be given static IP addresses, as well as the routers for the given subnets. These addresses will be excluded from the scope range so that they won’t be delivered accidently.

W.A.I IP Addressing Scheme

Department	# of hosts needed now	Address Range that will be Implemented	Subnet Mask & CIDR	# of hosts the scope can accommodate
Creative/Media/Production	49	192.168.0.1 – 192.168.0.254	255.255.255.0 /24	147
Accounts/Sales	15	192.168.1.1 – 192.168.1.62	255.255.255.192 /26	62
HR & Finance	12	192.168.1.64 – 192.168.1.126	255.255.255.192 /26	36
Executives	9	192.168.1.129 – 192.168.1.158	255.255.255.224 /27	30
IT	5	192.168.1.161 – 192.168.1.190	255.255.255.224 /27	15

In this proposal we’ve covered the necessary factors that should be considered when developing a network infrastructure from the ground-up, we truly appreciate you looking and reading over this proposal and taking it all into consideration. We’re honored that you’ve come to us to look over your networking infrastructure needs and would consider us in the implementation of it all. We hope that you will acquire our services for we will be sure that all technical and business aspects of your company are surely met.

REFERENCES:

Otey, M.  (2011, October 17). Windows IT Pro. Retrieved from http://windowsitpro.com/windows-server-2012/top-10-new-features-windows-server-2012

Uhing, A. (2012). Deploy MSI's through your network with GPO. Retrieved December 2, 2015, from https://community.spiceworks.com/how_to/8595-deploy-msi-s-through-your-network-with-gpo

Group scope. (2014, October 1). Retrieved December 2, 2015, from https://technet.microsoft.com/en-us/library/cc755692(v=ws.10).aspx

BranchCache Design Guide. (2009, November 4). Retrieved December 2, 2015, from https://technet.microsoft.com/en-us/library/ee731918(v=ws.10).aspx

Windows Server 2012 Standard License and VMs. (n.d.). Retrieved December 2, 2015, from https://social.technet.microsoft.com/Forums/windowsserver/en-US/02388f19-796c-4d20-8511-c124ac91ad41/windows-server-2012-standard-license-and-vms?forum=winserver8gen