Active directy advise

[agatong55]

With current laws that are about to take place for my work, we now need an active directy so I am looking at what is the best way to go about doing this.

We have about 500 employees with about 400 computers ( a lot of people share ) but spread out with 7 different locations. 

Would it just be easier to have 1 server and 1 backup located at 1 location or 1 server at each location?

I will be building over kill servers just as a ease of mind so thats not an issue for the config. but it just comes down to for those who have more experience with this what the best solution would be.

 

[Sir Asvald]

11 minutes ago, agatong55 said:

With current laws that are about to take place for my work, we now need an active directy so I am looking at what is the best way to go about doing this.

We have about 500 employees with about 400 computers ( a lot of people share ) but spread out with 7 different locations. 

Would it just be easier to have 1 server and 1 backup located at 1 location or 1 server at each location?

I will be building over kill servers just as a ease of mind so thats not an issue for the config. but it just comes down to for those who have more experience with this what the best solution would be.

 

It's recommended to have two DCs at the main site, and at the other sites you can get away with one, but again having 2 is ideal. Also I would make the DCs are in each site, read only as you don't want to have writable domain controllers, this helps with security.

 

Do forget to set up replication on each of the site DCs. 

[leadeater]

I'm surprised you didn't have AD already with that amount of employees and computers.

 

In general you want a Domain Controller at each site you have, they do not need to be powerful but it's generally not a good idea to make AD joined computers talk to AD across WAN links and other similar slower/high latency links, it gives a poor user experience among other issues.

 

Smaller sites with only a few computers it can be fine but honestly this is where an Intel NUC fits in well, low cost and will run Domain Controller role no trouble at all.

 

Your other option is actually Azure AD and Intune and no onsite/local Domain Controllers.

 

Realistically consult a local IT services company and get a design proposal and statement of work.