@dashrender said in AD best practices:
Well, this would be a reason for the non-profit to fire their paid consultants. The non-profit isn't looking for the best solution, instead they are keeping some consultants in cash for no reason.
I'm pretty sure @scottalanmiller would call this corruption.
Fear, not corruption. They are weaning themselves from old consulting firm, but worry that I (as an unpaid volunteer) will not always be available. They want to be left with a network that can be maintained by available resources.
My second DC will be at a second location connected by the 50 mb internet location. Both sites will have local authentication and the link is plenty to handle replication given the relatively small number of users.
The new servers are Dell T30s at $329 each. A 2 core Server 2016 pack costs $8 (16 required) and a CAL is $3. Fairly cost effective and they stay in their comfort zone.
I appreciate all of the feedback, especially regarding splitting DHCP and FS. I'm still unsure as to whether it's bad practice to run the FS on the same instance of Windows server as DC/DNS. I have a vague memory of reading that somewhere, but that's the way the former consultants set up the current server.
The MS license allows two VMs, so I can split the roles if it's needed and best to stay all MS, or offload FS and DHCP to linux. My take on the feedback so far (given that I'm definitely going with two physical servers running MS Server) is that offloading FS and DHCP roles is possible, but may create additional headaches and lose some degree of functionality.