Internal domain name same as external domain - DNS issues!!
-
While I probably did mention age, most would not fixate on it. As you said the important part is the number of users. Of course the expectation of someone posting here who has a brand new AD would be that they had a million users.
To me this is you being weird, fixating on a wit and not my intent - of course we're in IT and need to be specific.... But I'm posting from my phone, and often don't word things perfectly when doing so.
-
@Dashrender said:
If the while system is that new... It might be worth redoing AD....
How can I not fixate on it, it is the singular component of your point. There is no other factor at all.
-
@Dashrender said:
To me this is you being weird, fixating on a wit and not my intent - of course we're in IT and need to be specific.... But I'm posting from my phone, and often don't word things perfectly when doing so.
Perhaps, but if you had another intent, why did you only say age and not mention the thing that you intended? How am I to hear something that age from what was stated?
-
I'd ask you if you've ever know a new company that had a million users even inside their first year, buy then knowing you, you'd say yes and it would be true
-
@Dashrender said:
I'd ask you if you've ever know a new company that had a million users even inside their first year, buy then knowing you, you'd say yes and it would be true
LOL, of course. A million is a bit much, but I think you are dealing with a string of assumptions, which may be common, but nothing makes them true:
- That companies put in AD when they start up.
- That companies keep AD throughput their lifespans.
- That companies start with ten or fewer staff and grow organically over time.
- That AD is never introduced in the mid-stream of a company life. Or rebuild.
If any one of these four things is not true, and nothing makes any of them necessarily true for any company, then the age of AD would not tell us what we need to know.
-
If you are going by the logic that AD would start small, one could also argue, equally wrong, that if a company has an IT Pro they are already too large to consider rebuilding AD.
-
So for reference, the company is about 5 years old. They have 15 staff and growing (at reasonable pace) was mayhem to control users/passwords/group policies etc. Therefore having just joined the company myself, suggested getting some structure in place and to get the server...so yes, new server - established company.
PS - What settings do I need to do to get the active sync working? I did have this problem on a few computers...I couldn't understand why some worked and some didnt!! The ones that didnt, I changed DNS to Google and that helped autodiscover. then put it all back to DHCP. Which is why I questioned if emails will be okay in the initial post.
-
@Our-Tech-Team said:
So for reference, the company is about 5 years old. They have 15 staff and growing (at reasonable pace) was mayhem to control users/passwords/group policies etc. Therefore having just joined the company myself, suggested getting some structure in place and to get the server...so yes, new server - established company.
That is awfully small, it might be worth putting the users back in manually so that you don't have this issue going into the future. How much do you have depending on Active Directory? This would require creating a whole new AD system and moving people over to it, one by one.
-
@Our-Tech-Team said:
PS - What settings do I need to do to get the active sync working? I did have this problem on a few computers...I couldn't understand why some worked and some didnt!! The ones that didnt, I changed DNS to Google and that helped autodiscover. then put it all back to DHCP. Which is why I questioned if emails will be okay in the initial post.
Everything that you do with your public DNS (the one that Google DNS sees) you need to replicate manually in your own DNS system, always and forever. This is the penalty for having the overlapping names - there is no means for the desktops to talk to the public DNS. So just like you had to put in www manually, you need to do that with every entry.
-
Not a lot in AD. Of course the usual such as users/groups, some group policies and file share permissions.
So for example in my DNS, I'd need to manually add the office 365 records, such as MX records, autodiscover CNames etc?
-
@Our-Tech-Team said:
So for example in my DNS, I'd need to manually add the office 365 records, such as MX records, autodiscover CNames etc?
MX can be skipped unless you have an SMTP MTA somewhere on your LAN pointing to the DC for DNS resolution. But yes, all other entries need to be there.
Remember MX is for mail and you are not using email, you are using a web application. It's for email, but it is not email itself.
-
With only 15 users, personally, I would spend a weekend and reset up my AD environment just to avoid issues in the future.
-
@brianlittlejohn said:
With only 15 users, personally, I would spend a weekend and reset up my AD environment just to avoid issues in the future.
I would agree with @brianlittlejohn here. You had no AD at all prior too few days ago.
Just remove all the machines from the domain. Nuke your DC and start over.
-
@JaredBusch said:
@brianlittlejohn said:
With only 15 users, personally, I would spend a weekend and reset up my AD environment just to avoid issues in the future.
I would agree with @brianlittlejohn here. You had no AD at all prior too few days ago.
Just remove all the machines from the domain. Nuke your DC and start over.
As someone who does this a lot, even with more users than that, it's pretty simple.
I keep a few templates ready to go to deploy a base AD environment. Takes me ~3 minutes per end point to unjoin to the domain, about 2 hours to rebuild AD from template to completed environment, then ~3 minute per endpoint to rejoin. With that in mind, a 15 users environment, I could have it done in an afternoon while drinking beer.
Shit like this is easy as hell. Although I would be investigating the cost/benefit of having an AD environment for that few of users. Unless you have a case for it, Samba will do the job of authentication just fine. And a Samba domain is just as quick to deploy. Save quite a few bucks in the process. AD is great, I made my career around it, but it's not a need.
-
I've never used or worked with Samba so dont know anything about it. The AD I thought was great for them as they want to have more 'control' over users, add more security to the network and manage permissions on folders much better. I'm familiar with AD so thought it would suit them well.
The reason we named the domain name the same as their external domain is because a Microsoft technician advised me to do so if we wanted to Sync our Office365 tenant with the on-premise server.
I can easily nuke the DC and start over, but to re-configure the 15 computers and drag everything over to their new profile is easy, but frustrating to have to spend the extra time doing it as i've just done it for their new server!!!
-
@Our-Tech-Team said:
I've never used or worked with Samba so dont know anything about it. The AD I thought was great for them as they want to have more 'control' over users, add more security to the network and manage permissions on folders much better. I'm familiar with AD so thought it would suit them well.
Samba is just as much AD as Microsoft's DC is. Both are AD, just one is done from an open source project and one from Microsoft. It's not that Samba is not AD as well.
-
@Our-Tech-Team said:
The reason we named the domain name the same as their external domain is because a Microsoft technician advised me to do so if we wanted to Sync our Office365 tenant with the on-premise server.
Microsoft has been warning against this since the day AD was first released in 2000. It's, as far as I remember, the very first thing that they teach when starting hands on with AD in their courses and certs. Even in the NT4 era we were prepared to worry about it before upgrading to Windows 2000. This was a tech who actually worked for Microsoft and isn't aware of this? Something is fishy.
-
@Our-Tech-Team said:
... if we wanted to Sync our Office365 tenant with the on-premise server.
No such dependency.
-
@Our-Tech-Team said:
I've never used or worked with Samba so dont know anything about it. The AD I thought was great for them as they want to have more 'control' over users, add more security to the network and manage permissions on folders much better. I'm familiar with AD so thought it would suit them well.
The reason we named the domain name the same as their external domain is because a Microsoft technician advised me to do so if we wanted to Sync our Office365 tenant with the on-premise server.
I can easily nuke the DC and start over, but to re-configure the 15 computers and drag everything over to their new profile is easy, but frustrating to have to spend the extra time doing it as i've just done it for their new server!!!
You can use the AD migration tool if you spin up a new DC. Then it keeps all the SIDs for the users. Just join PC to new domain and it will keep using the profiles, no need to rebuild them. I just don't know if the setup for ADMT will take more time than just doing it manually for 15 users.
-
I havent worked with ADMT before but will look into it and if I'm capable of doing it and the time frames make sense, I'll go with it.....Otherwise when I have a spare weekend will probably nuke and start from scratch...Again if the main problem is ONLY that staff cant view their website internally then as far as I'm concerned this isnt a urgent problem that warrants immediate action. I'll create the DNS entries manually for the moment so hopefully it'll be okay for now...see the dns entired below, is this all I'll need to create (as well as the www record for the website)? Thanks again for your replies and responses.
