What goes on DC and member server?

Posted by Commercial-Fun2767@reddit | sysadmin | View on Reddit | 15 comments

Hello, I have inherited an environment with 40+ VMs and now I would like to reduce this number. It gives great flexibility to have on server for one service but it consumes a lot of ESX node power, implies more management (updates, upgrades, inventory, monitoring, …). For those services, how many VM would you create? - AD - azur ad connect - DNS - DHCP - Radius - NAPS - DFS - print server - licence server (some apps require small licence servers) - file server - small servers/tools (HP IMC, OCS inventory, AV, …) - tools consoles (Veam, firewall, …) - servers that clearly need their servers (veeam, sql server, IIS, finance tool, HR tool, …) For the moment we have: - DC includes Ad connect, DNS, DHCP and DFS. - Radius includes NAPS. - each other service is on a separate server

Reply to Post

15 Comments

[-]

TheRealJesh@reddit

Hopefully not a DoD contractor. If so don’t consolidate anything you’ll thank yourself later. Assuming you don’t blow your brains out with NIST and CMMC requirements changing every god damn year

[-]

Commercial-Fun2767@reddit (OP)

Nope, don’t have such constraints. I’m more a fireman then an IT guy. And seeing sysadmin Reddit posts about 2012R2 it came to my mind I should think about upgrading all this farm. My colleagues and I wanted to free resources on jour VMWare cluster since several years thinking there were to many VMs. Thanks to you all I understand one more time that my predecessor did a good job.

[-]

TheRealJesh@reddit

Yeah sometimes it’s best not to consolidate. Someone mentioned maintenance reasons. I can take down our Bartender license server and have the other 10 license run without an issue. Some are really picky like Mastercam or Glovius. There’s a fine balance between downtime (it maintenance), sanity, productivity and money. Keep your sanity

[-]

StevenNotEven@reddit

I would be tempted to put a lot of tools on the same VM if they're not critical, like it could be down for a day. Some tools may have access to equipment or other parts of your network that others don't, so there's a security risk I suppose, especially if the tool doesn't have its own security. I would also be tempted to combine things that Microsoft themselves do on single servers in smaller environments. I would then use freed up resources to create additional VMs on separate hosts for redundancy. I don't see a reason not to combine license servers unless the systems requiring the license needs constant and uninterrupted access to it and your organization cannot stand the app not grabbing that license for a little bit. License servers, while sometimes being a source of pain, are usually technically pretty simple. Just make sure they don't have competing software component requirements. Finally, admittedly without giving it too much thought, certain services are useless without others so if separated on separate VMs, how much benefit is it if one goes down and not the other? Anyway, probably contrarian but resource and management constraints are a real thing.

[-]

coolbeaNs92@reddit

Running DHCP, AD Connect and DFS (I assume you mean DFS that isn't for sysvol replication on a DC is a terrible idea.

[-]

Commercial-Fun2767@reddit (OP)

I’ve been told that about azur ad connect on DC but why not those 3 specifically? As we’ll live in hybrid mode for some time I’ll move this to a member server. Thx

[-]

tdic89@reddit

Don’t consolidate, look at better management and patching tools. Most of the time the OS is sitting in the background and isn’t doing a lot. Sure you might be able to save some RAM by merging some services, but it’s not going to be enough to justify going against best practice.

[-]

TMSXL@reddit

Yes and no. Some things can definitely be consolidated. If you’re a Windows shop why have a standalone DNS server when the DC does the same. File Server/Print Server? Easy to combine. The list goes on and on….there’s more benefits than just patching, like licensing and as OP mentioned, resources. Now that doesn’t mean load up every server with 10 different roles, but imo there’s absolutely nothing wrong with consolidating servers.

[-]

headcrap@reddit

My main reason for splitting off DNS is to be the target for static addressed devices. If/when the network team wants to replace it with dnsmasq or an L3 switch instead, fine. It also frees up changing DCs without DNS incidents or having to slide newDC into the address of oldDC..

[-]

tdic89@reddit

Point taken on DNS server. But I’d definitely keep print servers on their own VM based on the print spooler exploits we’ve seen in the last few years. Not sure what licensing concerns there are, you license the underlying hardware with Datacentre edition and that’s it.

[-]

TMSXL@reddit

That’s assuming they’re even using data center edition, which a ton of folks are not. You can point out any exploits, but that can happen to literally any tool. Are you going to deploy a full server for some rando 5MB tool? Of course not. Like I said, trying to consolidate as much as you can is a bad idea for a number or reasons. But deploying one server per tool is just a waste of time and resources. (Both literally and figuratively)

[-]

tdic89@reddit

Considering you can only run two virtual Windows OSEs on standard edition unless you start stacking licenses, datacentre edition is the sensible option if you’re virtualising Windows on any meaningful hardware. No of course not, let’s be sensible. It’s one _role_ per server. If you need a tool to support that role, it goes on that server. What you don’t do is combine unrelated roles, or roles which are more prone to being targeted for exploit. * NPS and RRAS, both are related to AAA so sure. * File server and print, no. * SQL and file server, no. * DC and anything else (apart from DNS)? No. If you consolidate roles, you’re increasing the chance of a single server being compromised, which leads to easier lateral movement.

[-]

maarack01@reddit

That all looks about right to me. You have to remember if you consolidate and one of those services fail it can make it harder to fix it during business house because now you are taking down more business-critical stuff. Guess who is staying up late/after hours to fix stuff now? Not your boss that's for sure.

[-]

slugshead@reddit

That's an environment of about 40-50 VMs. Consider what's actually running on your "small servers". I'm a big fan of IMC and it's actually my highest spec VM.

[-]

Cormacolinde@reddit

In genersl, best practice is to run each service on its own server. It increases security, makes troubleshooting easier, and improves reliability. AD Connect should not be on DC, ideally. You need at least two DCs. They should run DNS. They can run DHCP in smaller environments. Not clear why you think NPS and Radius are two different things, they’re the same service on Windows Server. This should be separate from DCs and are also a privileged control plane service so shouldn’t have “lesser” stuff. You could have AD connect on it. DFS/File sharing is the same thing. You can run print server on the same server in a smaller environment. Licence server varies, but can usually be run along other stuff, but it varies what ports are used, and if it needs a hardware key don’t mix it with other stuff. Mangement services like IMC that run their custom web services can be an issue if they all try to use the same ports.