Re: Two Server Setup Question.

Excellent Dennis.

What I don't understand is how a child domain works - particularly with
Authentication. Actually...now that I think about it... so
teacher@xxxxxxxxxx who is a admin/account operator of lab.school.org does
not have admin privileges in the school.org domain, right?

But administrator in the school.org domain does, have admin right to
lab.school.org, right?

Also:

There are about 20 computers in the lab and about 10-15 in admin. I have two
switches. Would two separate VLAN's or two subnets be appropriate. I don't
think broadcast traffic is a big issue with this setup and these switches.

Dave - in the other post - said he would just create to separate domains.
school.org and school2.org I suppose. Is this more secure?

Thanks!

"Dennis Chung [MVP]" <dennis@xxxxxxxx> wrote in message
news:eK9HVZVpGHA.2256@xxxxxxxxxxxxxxxxxxxxxxx
There are several scenarios you can create from there.
Assuming these followings;
Teacher has an account in school.org. But here, the teacher is a normal
user. Limited rights, just normal user. This can also be administration.

After that domain is up and the teacher has a normal account, say
teacher@xxxxxxxxxxx
You go on to build another child domain, lab.school.org
Put the teacher@xxxxxxxxxx as a domain admin / account operator in
lab.school.org.

Of course domain design wise will be like that.

But observing that you mention the new server will be school.org, and your
old server be lab.school.org. You have a few stage here to deal with.

Stage 1. Assuming your current old server is housing school.org. You need
to put your new server as school.org. You need to make the new server a
dc. Before you can add a w2k3 dc into a w2k domain, you need to perform
adprep. Go to support.microsoft.com and search for the adprep command to
extend the schema. Then you dcpromo to make the w2k3 box a DC. Subsequent,
leave it for about 30 mins.

Stage 2. You need to remove the old server and make it the DC for
lab.school.org. DCpromo your old server to remove it as a domain
controller. Remember to deal with your DNS/DHCP to reflect the new DC else
your clients will not be able to find the w2k3 DC. After dcpromo, it'll be
a normal member server of the domain.

Stage 3. Now you can put your old server as the dc for lab.school.org as a
DC by doing dcpromo.

Stage 4. In lab.school.org, you specify that TEacher@xxxxxxxxxx is a
member of lab.school.org\domain admin or account operators group.

Then i guess you're more or less done. :-)

--
Best Regards,
Dennis Chung

MCP, MCSA (2k3/Security), MCSE (2000/2003)
MCDBA, MCTS (SQL 2005), MCITP (SQL 2005 - DBA)
Microsoft Certified Trainer, Microsoft MVP - Windows

Microsoft Windows & SQL Server Advisory Panel Member
MS IT Academy - Mentor (APAC)
MS Vista & Office12 Influencer Lead (APAC)
Founder: Singapore Windows User Group (http://sgWindowsGroup.org)

"Purtech" <mikek(remove)@hlit.net> wrote in message
news:%23avhV%23RpGHA.1440@xxxxxxxxxxxxxxxxxxxxxxx
A school currently has one 2000 server. Single domain. Lets says
school.org.

They want to add a second server and upgrade both to Windows 2003
Standard.

They want the newer second server to be in administration, and the older
server to be in a computer lab.

They want administration and lab to have separate log in controls. The
teacher in charge of the lab server can add and removed student log ins.
However, he will have limited access to the administration server.

First: should I create two separate domains? administration.school.org
and lab.school.org. Or just create a lab.school.org under school.org?

They will not grow past this for years.

Thanks for you help.






.

Relevant Pages

  • Re: Two Server Setup Question.
    ... But administrator in the school.org domain does, ... Microsoft Certified Trainer, Microsoft MVP - Windows ... Microsoft Windows & SQL Server Advisory Panel Member ... They want the newer second server to be in administration, ...
    (microsoft.public.windows.server.setup)
  • Re: Workstation Addition
    ... > We run windows 2000 server, ... > I've already gone into the server and created a new account, ... how do i set up his / her workstation so that it prompts ... You may also want to add the user to the local admin group if you ...
    (microsoft.public.windows.server.general)
  • Re: Windows cannot find regedit
    ... If you are a beginner in Windows administration then the first ... but i am sure it was not an upgrade from a Windows 2000 to Win 2003 SBS. ... from a Windows 2000 server installation. ... I am facing a dilemma with respect to your "regedit" question ...
    (microsoft.public.windows.file_system)
  • Re: Two Server Setup Question.
    ... VPN between the admin and curriculum networks. ... Microsoft Certified Trainer, Microsoft MVP - Windows ... Microsoft Windows & SQL Server Advisory Panel Member ... Teacher has an account in school.org. ...
    (microsoft.public.windows.server.setup)
  • Re: Secure host newbie - fun - humm
    ... decision, as the admin, whether or not to take down the server. ... Listen, as a security specialist, I *know* that every single box that I, ... some level of risk and that there is no "100% I'm secure" level. ...
    (Security-Basics)
Loading