@scottalanmiller @dafyre
Thanks for the welcome! I'm a retired SW dev who now volunteers at 3 Boys and Girls Club locations keeping their network and servers running. I stumbled onto this great site when searching for info about XenServer since I'm being pushed into a switch from Hyper-V by the loss of 5nine Manager. I actually purchased the 5nine license a year ago, but no budget for renewal this year. I was going to get by with the limited, free version... so much for that plan.
As a side note, I've benefitted a good deal over the years by some of the valuable information provided by @scottalanmiller in posts on other sites, so I'm looking forward to lurking here for additional education

Although official support would be great (of course), I'm more concerned with a decent size user base, good documentation, and availability of configuration and troubleshooting information on the Web. VMware's pervasive presence makes it appealing in these areas. But, XS and KVM are also very well known and community support seems good.

After considering the options everyone has presented, I'm going to install and test KVM on a spare server, then move forward with either that or XS/XO. I think the value of an open source solution is the deciding factor for me in this particular case.

It does make me feel like less of a dunce that there are differing opinions even amongst smart, experienced IT guys like the group offering help here on ML I really appreciate all of the effort, information, and suggestions - thank you!

@scottalanmiller said in Hypervisor choice:

I often offer to volunteer my time as I think it is important. Most non-profits turn away IT volunteers, though... too much money to be made handing money off to friends reselling stuff heavily marked up. It's so lucrative that nearly all non-profits I come across will have nothing to do with anyone honest in IT.

Exactly the situation I found when I stepped in. I was disgusted by the waste I found, the unopened network equipment scattered around the offices, the contracts in place for unused support, and on and on. One former staff member had actually been hired by the IT services firm doing most of the work.

Luckily, a new director had recently been hired to oversee operations at all three clubs in the area and he questioned the spending taking place. At this point, they are probably a little too tight, but once bitten...

@hobbit666 If you want to stay with Ubuntu (which is based on Debian), you might have a look at NoMachine for remote desktop. The default NX protocol of NoMachine is a bit more responsive than VNC under Linux in my experience and gives you remote audio.

That said, VNC should work. You might want to try un-commenting the line ‘force_hdmi_hotplug=1’ in /boot/config.txt. That will force the pi to act as if a monitor is plugged into the hdmi port at boot if you're running headless.

@scottalanmiller @JaredBusch

Thanks for the suggestions. I actually evaluated Proxmox along with XS and liked the fact that it was KVM based, but didn't like the confused business model (free/not free) and the steep licensing fees for paying customers.

I want a management GUI and didn't know about virt-manager until I saw a reference here. Maybe I need to re-evaluate.

I run Linux on my desktop and laptops, so I'm not opposed to doing some cli management, but like XO (already built from source using @scottalanmiller 's script).

So, should I back out XS now while it's early? Maybe I need to move that question out of the Welcome section?

This seems like a small amount compared to switching the whole platform. Plus I thought they had no budget for the renewal? But now they can come up with $700 less?

See my comment above about loss of trust. What about next year when it becomes $5000 / year and this year's license expires leaving zero functionality? I'm out.

I had 5x s905x Android boxes scattered around my house. A different brand (Nexbox), but it seems all brands are pretty much an Amlogic reference design.

I really liked them - fast and flexible. I was able to set up the interface to be usable for family. Apps for everything imaginable and auto-update.

Unfortunately, we took a lightning strike nearby a few month ago and it fried every one of the boxes, plus a couple of network switches. No other end devices, just those TV boxes.

I added several network surge surpressors throughout the house and replaced the TV boxes with Fire TVs. I prefer the Nexbox to the Fire TV. Amazon makes it tough to change the launcher and the new interface is much more concerned with selling you something than helping you find what you want to watch.

I think you'll be pleased with the Android box.

I also understand that my use case is not typical. I believe strongly in the work the B&G Clubs do and am happy that the money they are saving on IT can be used to provide other services for the kids. If this were a for-profit or the unit directors I work with were pulling down big bucks, my criteria would be different. These local clubs do good work on a shoe string budget.

@dashrender said in AD best practices:
...

So in your case I would be more apt to setup an AD/DNS/DHCP VM and a file serving VM. At minimum I'd probably put DNS on the second VM as well - this would allow you use Windows DNS and reboot either VM without causing an internet interruption.

@wirestyle22 said in [AD best practices]

It can seriously hinder your work to not be able to reboot your domain controller at will.

Thank you - that's exactly the input I was looking for. So single DC with DNS, DHCP on one VM and another VM on the same physical machine running DNS and FS. Perfectly simple - easy to install and maintain.

@hobbit666 If you want to stay with Ubuntu (which is based on Debian), you might have a look at NoMachine for remote desktop. The default NX protocol of NoMachine is a bit more responsive than VNC under Linux in my experience and gives you remote audio.

That said, VNC should work. You might want to try un-commenting the line ‘force_hdmi_hotplug=1’ in /boot/config.txt. That will force the pi to act as if a monitor is plugged into the hdmi port at boot if you're running headless.

@dashrender said in AD best practices:
...

So in your case I would be more apt to setup an AD/DNS/DHCP VM and a file serving VM. At minimum I'd probably put DNS on the second VM as well - this would allow you use Windows DNS and reboot either VM without causing an internet interruption.

@wirestyle22 said in [AD best practices]

It can seriously hinder your work to not be able to reboot your domain controller at will.

Thank you - that's exactly the input I was looking for. So single DC with DNS, DHCP on one VM and another VM on the same physical machine running DNS and FS. Perfectly simple - easy to install and maintain.

@dashrender said in AD best practices:

@jfath said in AD best practices:

@dashrender said in AD best practices:

that is very old thinking, and wasn't even right back then. physical DC haha...

Sorry, I meant two DC VMs running on two separate physical machines, not actually physical DCs.

@scottalanmiller said in AD best practices:

That's a lot of money. Is there any value to it? I mean that literally - is there any at all?

Nope, absolutely none. And that's my mistake - there's much misinformation on the Internet that says it's a best practice and my lack of experience prompted me to accept it. That's why I asked you smart guys. I'll put the second server in my home lab or deploy it somewhere that it actually makes sense.

Convincing them to go with a non-AD/MS solution is another matter. Simply not going to happen.

So... still the remaining first question - is there any problem with putting DC, DNS, DHCP, and FS roles all on a single VM? Should FS be split?

@dashrender said in AD best practices:
...

Make good backups, test the backups and go. One DC, One server should be all that's needed.

Good to know and makes my life easier. Not having much experience in this area, I was following the 'wisdom' of the Internet that seems to insist on separate physical primary and secondary DCs for every installation.

@dashrender Yep, T30 are the low end Dell servers. ECC and single Xeon E3-1225, but no redundant PS. I'll throw in an LSI HW raid controller before deployment. And the $329 price was a one day sale. Just AD replication between sites.

@dashrender said in AD best practices:

Well, this would be a reason for the non-profit to fire their paid consultants. The non-profit isn't looking for the best solution, instead they are keeping some consultants in cash for no reason.
I'm pretty sure @scottalanmiller would call this corruption.

Fear, not corruption. They are weaning themselves from old consulting firm, but worry that I (as an unpaid volunteer) will not always be available. They want to be left with a network that can be maintained by available resources.

My second DC will be at a second location connected by the 50 mb internet location. Both sites will have local authentication and the link is plenty to handle replication given the relatively small number of users.

The new servers are Dell T30s at $329 each. A 2 core Server 2016 pack costs $8 (16 required) and a CAL is $3. Fairly cost effective and they stay in their comfort zone.

I appreciate all of the feedback, especially regarding splitting DHCP and FS. I'm still unsure as to whether it's bad practice to run the FS on the same instance of Windows server as DC/DNS. I have a vague memory of reading that somewhere, but that's the way the former consultants set up the current server.

The MS license allows two VMs, so I can split the roles if it's needed and best to stay all MS, or offload FS and DHCP to linux. My take on the feedback so far (given that I'm definitely going with two physical servers running MS Server) is that offloading FS and DHCP roles is possible, but may create additional headaches and lose some degree of functionality.

I do plan to use a second physical machine with another Win Server VM as the secondary DC. I understand AD well enough to know why it's important to have two if you're going to have one.

The non-profit wants to stay with Win Server and AD because their paid consultants won't support anything else. esxi to KVM doesn't matter as much because it won't change authentication admin. I think I can run a Linux VM for FS because they'll see no difference after initial setup and I really want to use Win Server for as little as possible.

Tech Soup offers Win Server licenses (yes, CALs too) at extremely low prices for non-profits, so that's covered. They've already purchased more than enough.

I am interested in @dbeato 's statement about DHCP on a DC integrating with DNS. Are there things that can't be accomplished with a separate DHCP server and IP reservations for shared resources? I know I need to use Win Server for DNS in an AD environment, but are there compelling reasons to keep DHCP on the server too? Do I end up manually setting up DNS entries if I use a separate server?

I'm updating a MS Server running 2008 at a local non-profit. I'm more of a Linux dev than a network admin, but it's volunteer work, so they're getting what they pay for...

The current server is a single VM running on esxi as primary (and only) DC along with DNS, DHCP, and file server. I''ll be adding a second DC shortly - especially at Tech Soup prices, no need to be without.

I've read that the FS should be on a separate VM. I'm also not crazy about running DHCP on MS Server since any little cheap embedded device can fill that role and might be more reliable (my experience). They have Comcast IP phones which use DHCP, I'd like to keep them working if the server goes down.

So my thought is run DNS and AD PDC on a single VM under KVM, run a Linux VM and samba for FS, and use DHCP from the Comcast gateway router or pfsense once I have that installed on a nuc.

BTW - less than 50 devices on the network an 50 mb service.

Does my plan sound reasonable, or is there a better way? Any reason to keep DHCP on the MS server VM?

Thanks.

I had 5x s905x Android boxes scattered around my house. A different brand (Nexbox), but it seems all brands are pretty much an Amlogic reference design.

I really liked them - fast and flexible. I was able to set up the interface to be usable for family. Apps for everything imaginable and auto-update.

Unfortunately, we took a lightning strike nearby a few month ago and it fried every one of the boxes, plus a couple of network switches. No other end devices, just those TV boxes.

I added several network surge surpressors throughout the house and replaced the TV boxes with Fire TVs. I prefer the Nexbox to the Fire TV. Amazon makes it tough to change the launcher and the new interface is much more concerned with selling you something than helping you find what you want to watch.

I think you'll be pleased with the Android box.

Although official support would be great (of course), I'm more concerned with a decent size user base, good documentation, and availability of configuration and troubleshooting information on the Web. VMware's pervasive presence makes it appealing in these areas. But, XS and KVM are also very well known and community support seems good.

After considering the options everyone has presented, I'm going to install and test KVM on a spare server, then move forward with either that or XS/XO. I think the value of an open source solution is the deciding factor for me in this particular case.

It does make me feel like less of a dunce that there are differing opinions even amongst smart, experienced IT guys like the group offering help here on ML I really appreciate all of the effort, information, and suggestions - thank you!