redesigning AD

  • Thread starter Thread starter GKurcon
  • Start date Start date
G

GKurcon

I currently have two Windows 2000 forests within the same building for
a small municipal organization. I am trying to consolidate all of the
networks into one coherent network. We currently have an Exchange
2000 server in one of the forests that provides internal mail for the
users of that particular forest. Here is a brief description of how
my network is set up:

Existing user-approximately 100

FOREST A-
1 Domain
1 Windows 2000 Server-Acting as the only domain controller, provides
terminal services for the Financial package that the city uses, is
part of an integrated AS400 legacy system (the server must be shut
down via the AS400, and shares a disk array with the AS400 also)

FOREST B-
1 Domain
1 Windows 2000 Server-Acting as the only domain controller, provides
Exchange services for the domain, provides file and print services for
the domain.

Problems with the network as I see it:

1.Forest A and B both have only one domain controller, so right now
there is no fault tolerance in this design.

2.I am not too excited about running terminal services on a domain
controller either (although I did set up a group policy that prevents
users from doing much of anything other than running the finance app).

3. Only users of Forest B have access to Exchange, and even those
users have no access to internet mail through Exchange.

4. If the shared storage or the AS400 in Forest A goes down, so does
my domain controller and forest. I feel that the DC should not be
part of the AS400 at all.

My plan is to start from scratch and create a new forest and migrate
all of my users to a single domain. I also want to provide Exchange
services for all of the users. Here is how I intend to rebuild the
network:

Reconfigure two existing servers for the new forest, both will be
domain controllers, and will provide file and print services.

Order one new server to act as a terminal server, this will be a
member server.

Order a second new server for Exchange.

Here are the questions that I have as I am planning this out:

1. We have registered a domain name, should I use this domain name on
the internal network, or should I have two separate domains, one
public, and one private?

2. Does it matter if I install Exchange on the DC? Is it better to
install Exchange on a member server?

3. I want to be able to send and receive internet mail through
Exchange, would I need to set up an SMTP gateway server on the outside
of the firewall to do this, or can I use the SMTP virtual server and
the firewall's port forwarding to forward internet mail to the
appropriate locations?
 
Answer: Question number one. Microsoft best practice is to use a registered
name as well as not to use the same external namespace as internal.



If for example you're external registered name space is 'mycompany.com' than
the best to use is for example 'somename.mycompany.com'. Since
'mycompany.com' is a registered name, hypothetically, then
''somename.mycompany.com' also will be.



Hope that answers your question number one. See the Microsoft Windows 2003
deployment guide even if you are deploying Windows 2000.



Next answer: Yes it is better to install Exchange on a member server. I
would not install Exchange on a domain controller.



Post the[I want to be able to send and receive internet mail through
Exchange, would I need to set up an SMTP gateway server on the outside
of the firewall to do this, or can I use the SMTP virtual server and
the firewall's port forwarding to forward internet mail to the
appropriate locations?] question to the microsoft.public.exchange.design
forum.
 
You can forward port 25 on the firewall to the exchange server and use it as
your MX. Make sure you don't have an open relay though.

You can certainly get away with Exchange on a DC, it isn't recommended
though.

--
--
Brian Desmond
Windows Server MVP
(e-mail address removed)12.il.us

Http://www.briandesmond.com
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Back
Top