ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Where do I start with replacing the whole MS AD stack

    Water Closet
    microsoft active directory ad dhcp dns
    8
    104
    8.8k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DashrenderD
      Dashrender @DustinB3403
      last edited by

      @DustinB3403 said in Where do I start with replacing the whole MS AD stack:

      Why would you have no internal dns?

      If you don't have AD and don't have internal servers - why do you need internal DNS?

      DustinB3403D JaredBuschJ 2 Replies Last reply Reply Quote 0
      • DonahueD
        Donahue @Dashrender
        last edited by

        @Dashrender said in Where do I start with replacing the whole MS AD stack:

        @JaredBusch said in Where do I start with replacing the whole MS AD stack:

        You need to have your DNS use your AD server as it's forwarder, but everything else can look at your DNS.

        How will this affect licensing? Do you only need one CAL for that DNS server, since it's the only thing actually talking to the server? Interesting work-around to MS licensing.

        I believe that MS believes that ANY device that gets info that is passed along using DNS requires a CAL. It doesn't matter who hosts the DHCP, if it is still point to MS DNS.

        DustinB3403D DashrenderD 2 Replies Last reply Reply Quote 0
        • DustinB3403D
          DustinB3403 @Dashrender
          last edited by

          @Dashrender said in Where do I start with replacing the whole MS AD stack:

          @DustinB3403 said in Where do I start with replacing the whole MS AD stack:

          Why would you have no internal dns?

          If you don't have AD and don't have internal servers - why do you need internal DNS?

          Nothing in the original post (until a very recent one) stated there were no on-prem servers. Hence the question.

          DonahueD 1 Reply Last reply Reply Quote 0
          • DustinB3403D
            DustinB3403 @Donahue
            last edited by

            @Donahue said in Where do I start with replacing the whole MS AD stack:

            @Dashrender said in Where do I start with replacing the whole MS AD stack:

            @JaredBusch said in Where do I start with replacing the whole MS AD stack:

            You need to have your DNS use your AD server as it's forwarder, but everything else can look at your DNS.

            How will this affect licensing? Do you only need one CAL for that DNS server, since it's the only thing actually talking to the server? Interesting work-around to MS licensing.

            I believe that MS believes that ANY device that gets info that is passed along using DNS requires a CAL. It doesn't matter who hosts the DHCP, if it is still point to MS DNS.

            You'd replace them one at a time and eventually not care about MS Licensing besides for the user workstations.

            1 Reply Last reply Reply Quote 1
            • DonahueD
              Donahue @JaredBusch
              last edited by

              @JaredBusch said in Where do I start with replacing the whole MS AD stack:

              @Donahue said in Where do I start with replacing the whole MS AD stack:

              I am in the middle of changing all my DHCP stuff, which is what prompted this whole thing. I want to switch over to reservations for everything, but it got me thinking about CALs, and it all snowballed from there.

              Well first, you don't change anything.

              Get it cleaned up and in a known good working state.

              I just redid our scopes yesterday, but I have not yet started migrating over our static IP's to be reservations. I can get everything setup in windows first, and then migrate it over as @black3dynamite said, but that seems like extra steps to me.

              JaredBuschJ 1 Reply Last reply Reply Quote 0
              • DashrenderD
                Dashrender @Donahue
                last edited by

                @Donahue said in Where do I start with replacing the whole MS AD stack:

                @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                Unless you have a need for a fully managed DNS system with a fuck ton of records, I recommend just using the system that is doing the DHCP. Router, pfSense, WTF ever.

                I've got just our 50 or so workstations and then our servers as records. I don't need much.

                Why are you worried about CALs at all? You have at least 50 device CALs to cover those 50 devices - just don't allow other devices on that specific network. If you are allowing personal phones/laptops on WiFi - create a separate network for them, that gets DNS and DHCP from the router (most likely at least).

                DonahueD 1 Reply Last reply Reply Quote 1
                • DonahueD
                  Donahue @DustinB3403
                  last edited by

                  @DustinB3403 said in Where do I start with replacing the whole MS AD stack:

                  @Dashrender said in Where do I start with replacing the whole MS AD stack:

                  @DustinB3403 said in Where do I start with replacing the whole MS AD stack:

                  Why would you have no internal dns?

                  If you don't have AD and don't have internal servers - why do you need internal DNS?

                  Nothing in the original post (until a very recent one) stated there were no on-prem servers. Hence the question.

                  correct, I did not mention that this all occurred as we were introducing on prem servers for the first time.

                  1 Reply Last reply Reply Quote 0
                  • JaredBuschJ
                    JaredBusch @Dashrender
                    last edited by

                    @Dashrender said in Where do I start with replacing the whole MS AD stack:

                    @DustinB3403 said in Where do I start with replacing the whole MS AD stack:

                    Why would you have no internal dns?

                    If you don't have AD and don't have internal servers - why do you need internal DNS?

                    He has AD. THis is not news. There have been many posts about his network over the last month+

                    DashrenderD 1 Reply Last reply Reply Quote 0
                    • scottalanmillerS
                      scottalanmiller @JaredBusch
                      last edited by

                      @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                      @scottalanmiller said in Where do I start with replacing the whole MS AD stack:

                      @DustinB3403 said in Where do I start with replacing the whole MS AD stack:

                      Why would you have no internal dns?

                      LANless? Other than being a cache, often no need for internal DNS.

                      Unrelated to this discussion.

                      Maybe not to the discussion, but it answers the question that Dustin asked.

                      DustinB3403D 1 Reply Last reply Reply Quote 1
                      • DustinB3403D
                        DustinB3403 @scottalanmiller
                        last edited by

                        @scottalanmiller said in Where do I start with replacing the whole MS AD stack:

                        @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                        @scottalanmiller said in Where do I start with replacing the whole MS AD stack:

                        @DustinB3403 said in Where do I start with replacing the whole MS AD stack:

                        Why would you have no internal dns?

                        LANless? Other than being a cache, often no need for internal DNS.

                        Unrelated to this discussion.

                        Maybe not to the discussion, but it answers the question that Dustin asked.

                        It really doesn't because he clearly has AD, which is a Server. Just because there are no services on the network that needed DNS, doesn't equate to lanless.

                        1 Reply Last reply Reply Quote 0
                        • DonahueD
                          Donahue @Dashrender
                          last edited by

                          @Dashrender said in Where do I start with replacing the whole MS AD stack:

                          @Donahue said in Where do I start with replacing the whole MS AD stack:

                          @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                          Unless you have a need for a fully managed DNS system with a fuck ton of records, I recommend just using the system that is doing the DHCP. Router, pfSense, WTF ever.

                          I've got just our 50 or so workstations and then our servers as records. I don't need much.

                          Why are you worried about CALs at all? You have at least 50 device CALs to cover those 50 devices - just don't allow other devices on that specific network. If you are allowing personal phones/laptops on WiFi - create a separate network for them, that gets DNS and DHCP from the router (most likely at least).

                          that wasn't the point. The point was to get off AD/DHCP/DNS because of, and not limited to, stupid licensing.

                          DustinB3403D 1 Reply Last reply Reply Quote 0
                          • JaredBuschJ
                            JaredBusch @Donahue
                            last edited by

                            @Donahue said in Where do I start with replacing the whole MS AD stack:

                            @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                            @Donahue said in Where do I start with replacing the whole MS AD stack:

                            I am in the middle of changing all my DHCP stuff, which is what prompted this whole thing. I want to switch over to reservations for everything, but it got me thinking about CALs, and it all snowballed from there.

                            Well first, you don't change anything.

                            Get it cleaned up and in a known good working state.

                            I just redid our scopes yesterday, but I have not yet started migrating over our static IP's to be reservations. I can get everything setup in windows first, and then migrate it over as @black3dynamite said, but that seems like extra steps to me.

                            If you have a stbale point, then sure. do it then.

                            Again, don't worry about adding reservations. Just setup the DHCP scope and options on the new system witht he appropriate DNS and then shutdown the MS DHCP service.

                            THen once working AS-IS, you start adding in the reservations.

                            Do everything once step at a time.

                            1 Reply Last reply Reply Quote 1
                            • DustinB3403D
                              DustinB3403 @Donahue
                              last edited by

                              @Donahue said in Where do I start with replacing the whole MS AD stack:

                              @Dashrender said in Where do I start with replacing the whole MS AD stack:

                              @Donahue said in Where do I start with replacing the whole MS AD stack:

                              @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                              Unless you have a need for a fully managed DNS system with a fuck ton of records, I recommend just using the system that is doing the DHCP. Router, pfSense, WTF ever.

                              I've got just our 50 or so workstations and then our servers as records. I don't need much.

                              Why are you worried about CALs at all? You have at least 50 device CALs to cover those 50 devices - just don't allow other devices on that specific network. If you are allowing personal phones/laptops on WiFi - create a separate network for them, that gets DNS and DHCP from the router (most likely at least).

                              that wasn't the point. The point was to get off AD/DHCP/DNS because of, and not limited to, stupid licensing.

                              So to summarize this, you have licensing already. Don't want to purchase more and can't legally add devices without violating MS's terms.

                              Hence the question of how do I move off of these services. >>>>> Start with Jared's first post here.

                              1 Reply Last reply Reply Quote 2
                              • DonahueD
                                Donahue
                                last edited by

                                @DustinB3403 and @JaredBusch agreed on both points.

                                DashrenderD 1 Reply Last reply Reply Quote 0
                                • DashrenderD
                                  Dashrender @Donahue
                                  last edited by

                                  @Donahue said in Where do I start with replacing the whole MS AD stack:

                                  @Dashrender said in Where do I start with replacing the whole MS AD stack:

                                  @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                                  You need to have your DNS use your AD server as it's forwarder, but everything else can look at your DNS.

                                  How will this affect licensing? Do you only need one CAL for that DNS server, since it's the only thing actually talking to the server? Interesting work-around to MS licensing.

                                  I believe that MS believes that ANY device that gets info that is passed along using DNS requires a CAL. It doesn't matter who hosts the DHCP, if it is still point to MS DNS.

                                  Right - JB's got a kinda work around though.

                                  PC asks router for DNS
                                  Router asks Windows for DNS

                                  In this setup that JB suggests only this one box - the router ever talks to windows DNS, so.... you only need one CAL for that router.

                                  DonahueD 1 Reply Last reply Reply Quote 0
                                  • DashrenderD
                                    Dashrender @JaredBusch
                                    last edited by

                                    @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                                    @Dashrender said in Where do I start with replacing the whole MS AD stack:

                                    @DustinB3403 said in Where do I start with replacing the whole MS AD stack:

                                    Why would you have no internal dns?

                                    If you don't have AD and don't have internal servers - why do you need internal DNS?

                                    He has AD. THis is not news. There have been many posts about his network over the last month+

                                    You know that he does NOW - I was answering Dustin's post about why he didn't have internal back then... at a time when he didn't have AD.

                                    DustinB3403D 1 Reply Last reply Reply Quote 0
                                    • DustinB3403D
                                      DustinB3403 @Dashrender
                                      last edited by

                                      @Dashrender said in Where do I start with replacing the whole MS AD stack:

                                      @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                                      @Dashrender said in Where do I start with replacing the whole MS AD stack:

                                      @DustinB3403 said in Where do I start with replacing the whole MS AD stack:

                                      Why would you have no internal dns?

                                      If you don't have AD and don't have internal servers - why do you need internal DNS?

                                      He has AD. THis is not news. There have been many posts about his network over the last month+

                                      You know that he does NOW - I was answering Dustin's post about why he didn't have internal back then... at a time when he didn't have AD.

                                      He has had AD for some time now though. I came into this topic knowing that 1) based on the topic! 2) from previous conversations.

                                      The no internal DNS portion is still "weird" when he had the other pieces.

                                      DashrenderD 1 Reply Last reply Reply Quote 0
                                      • DashrenderD
                                        Dashrender @Donahue
                                        last edited by

                                        @Donahue said in Where do I start with replacing the whole MS AD stack:

                                        @DustinB3403 and @JaredBusch agreed on both points.

                                        I'm sorry, there's nothing quoted - so I'm not sure what points you're talking about?

                                        DonahueD 1 Reply Last reply Reply Quote 0
                                        • DashrenderD
                                          Dashrender @DustinB3403
                                          last edited by

                                          @DustinB3403 said in Where do I start with replacing the whole MS AD stack:

                                          @Dashrender said in Where do I start with replacing the whole MS AD stack:

                                          @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                                          @Dashrender said in Where do I start with replacing the whole MS AD stack:

                                          @DustinB3403 said in Where do I start with replacing the whole MS AD stack:

                                          Why would you have no internal dns?

                                          If you don't have AD and don't have internal servers - why do you need internal DNS?

                                          He has AD. THis is not news. There have been many posts about his network over the last month+

                                          You know that he does NOW - I was answering Dustin's post about why he didn't have internal back then... at a time when he didn't have AD.

                                          He has had AD for some time now though. I came into this topic knowing that 1) based on the topic! 2) from previous conversations.

                                          The no internal DNS portion is still "weird" when he had the other pieces.

                                          that's because he mentioned it about the past - and perhaps you read or though he might have been talking about the present.

                                          1 Reply Last reply Reply Quote 0
                                          • DonahueD
                                            Donahue @Dashrender
                                            last edited by

                                            @Dashrender said in Where do I start with replacing the whole MS AD stack:

                                            @Donahue said in Where do I start with replacing the whole MS AD stack:

                                            @DustinB3403 and @JaredBusch agreed on both points.

                                            I'm sorry, there's nothing quoted - so I'm not sure what points you're talking about?

                                            the two posts immediately above that one.

                                            1 Reply Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 3
                                            • 4
                                            • 5
                                            • 6
                                            • 2 / 6
                                            • First post
                                              Last post