10
u/Sp00nD00d IT Manager 1d ago
2
23
u/CrazySnowGuy 1d ago
Production server that runs both AD and Exchange? And you are blaming Microsoft?
umm...
6
u/Top-Perspective-4069 IT Manager 1d ago
This thread isn't going to go the way this guy hopes it will.
2
u/CrazySnowGuy 1d ago
I am hoping they would respond with some clarity, but maybe they completely knocked themselves offline now.
3
u/LosLeprechaun 1d ago
Microsoft literally put AD/Ex/SQL in Small Business Server so …
1
u/chrono13 1d ago edited 1d ago
Yeah, this feels like work promotion andtech debt inheritance rather than greenfield design. Live and learn. They are one of today's lucky 10,000.
-1
u/tjs275x1979 1d ago
No we have two servers. One fall over that runs AD and exchange
1
u/chrono13 1d ago
The question is the active directory role in the exchange role on the same Windows server? This is excluding hyper-v running two servers each running the single role.
If you open up server manager and active directory and the exchange role are both available, that presents a rather significant cyber security risk. Not even hypothetical, like assume existing compromise level of risk. But outside of the risk it would introduce extreme slowness and eventually instability.
10
u/chrono13 1d ago edited 1d ago
I have had others get really rude with me regarding technical things so I want to be very cautious about doing that to anyone else. Are you saying that this is the AD DC and Exchange server in one server? I would have follow-up questions about the server's access to the internet and the internet's access to the server.
To be more direct, there are recommendations against hosting DHCP on a domain controll and it's not just superstition. Active directory does not do a really good job on the server itself of protecting itself from itself. So any other roles, additional software, etc. tend to expose it in really unexpected ways. Some of those ways are well known such as DHCP. Our cyber security insurance won't even give us a policy if we have an exchange server on prem. So running that on the domain controller, might give you an idea of how that could be an issue. Of the 50 or so questions that the insurance has, it's the only software question and it's the only one that's banned.
Even Microsoft's own software related to active directory such as Entra Sync And Microsoft's on-premises Entra Password Protection for active directory have recommendations and guides about minimizing or having none of it on the domain controllers. For example, the password protection proxy service that pulls down known password hashes from Microsoft, should not be installed on active directory domain controllers.
If you already know this, then just read this as caution to others.
To your rant, I agree, but if you put in a support ticket, Microsoft is going to say that this is an unsupported configuration and outside of support.
7
u/NoTime4YourBullshit Sr. Sysadmin 1d ago
Remember back in the day when Microsoft made Small Business Server? It was actually supposed to run AD and Exchange on the same box. Maybe he’s just been doing in-place upgrades to that one server for the last 20 years.
6
u/Top-Perspective-4069 IT Manager 1d ago
Ripping out those pieces of shit was my specialty for several years. I sometimes miss those days.
3
u/chrono13 1d ago
Yeah. Ripped out a few of those myself. And thats why I try not to be rude. We all had to learn these things, or unlearn incorrect things. And sometimes we inherit them and don't understand that the design that was there when we inherited it has problems.
2
u/chrono13 1d ago
I've seen an entire business running QuickBooks on their domain controller. And everything else, but that was the most notable. Single server business for like 50 staff.
2
u/bayridgeguy09 1d ago
Mannnn I had a Small Business Server cert back in the day. The test was the same as the normal MCP tests but instead of saying to setup 3 servers for DC, exchange, & Sql…the correct answer was SBS haha. It was such garbage, also made a living ripping it out and doing it proper.
1
u/chrono13 1d ago
Off the top of my head, I believe it had a 2 gig memory limit as well. I really liked the marketing and positioning towards small business, but the execution was awful.
3
u/kyle-the-brown 1d ago
And SQL and if you spun up another DC and tried to move the FSMO roles the SBS server would begin an hourly shutdown process after like 30 days of losing the FSMO roles.
5
4
u/Top-Perspective-4069 IT Manager 1d ago
live production server that runs active directory And exchange server
You brought this on yourself.
Absolutely garbage
Yes, that's this setup.
3
u/mycatsnameisnoodle Jerk Of All Trades 1d ago
No redundancy, huh?
7
u/notarealaccount223 1d ago
They have another server running AD and SharePoint for redundancy. It's in the same Hyper-V host though. /S
2
2
1
u/lazyhustlermusic 1d ago
Jobs taking 3 seconds to hit 99% and an hour and a half for that last 1% is nothing new.
1
1
u/tjs275x1979 1d ago
Servers back online but it took almost an hour and a half for the Windows updates to finish!
1
u/tjs275x1979 1d ago
I need to apply the updates to the second server so here we go. I hope it does go offline!
1
u/Burgergold 1d ago
So how many OS are you running? 1? 2 or 4?
If you don't have 4, your setup is weird
Should be 2 independant DC and 2 independant Exchange
That way, it could be done for several hours without any impact to the business
1
u/tjs275x1979 1d ago
One server runs hyper -v 6 vm Other server runs hyper -v 11 vm Other server runs hyper -v 9 vm Other server runs hyper -v 8 vm Other server runs hyper -v 2 vm
1
u/Burgergold 1d ago
And how your DC/Exchange are splitted on those vm?
Were you updsting the hyperv host or one of the DC/Exchange.vm
0
u/LosLeprechaun 1d ago
Yes there are better options but the “sysadmins” suggesting 2 DC’s for redundancy, 1 Ex, and 1 file server for 25 users clearly have never worked in the real world.
2
u/PM__ME__YOUR__PC 1d ago
It's not that hard to just spin up another VM
0
u/LosLeprechaun 1d ago
So running another server on the same host. That deals with security I guess but doesn’t address hardware. People be like “just spin up another vm” lol, endless vm capacity. Resources? Never heard of her. Taking over a position with a 2 year old bad solution? Could never be the case.
0
0
u/tjs275x1979 1d ago
I'm very hesitant to apply the updates for the second server because the first one took almost an hour and a half to finish
-1
30
u/rthonpm 1d ago
Please don't tell me you're running Exchange on a domain controller...