Building a PC to be used as a Active Directory domain controller?


Recommended Posts

Hey

Just to train (and play around), I'm looking to build a PC to use as a Active Directoy domain controller (among other things) This will be its only use and frankly only 2 PCs in my home can connect to a domain. So key here is budget. The only thing I see really is 2 ethernet ports. That's it.

Thanks!

You shouldn't need two Ethernet ports for a DC. Also, it might be good to use VirtualBox to play around with

In a proper DC setup you do..

ETH1 ETH2

Modem -------- > DC ---------> Switch/Router

This way my DC acts also as a firewall.

Virutalbox (VMWare) isnt the same thing.

Hey

Just to train (and play around), I'm looking to build a PC to use as a Active Directoy domain controller (among other things) This will be its only use and frankly only 2 PCs in my home can connect to a domain. So key here is budget. The only thing I see really is 2 ethernet ports. That's it.

Thanks!

For a lab-type DC, here's the spec skinny (my take):

CPU - Intel Core i5 (LGA1155) - Quad-core makes way too much sense for any sort of domain controller (even one for a micro-domain); however, you don't need HT for a lab-based DC (and you wouldn't overclock a server, let alone a DC, therefore no K-series). Safe bets - i5-2300 or i5-2310 (either is $179.99 @ Newegg)

Motherboard - BIOSTAR TZ77A - A Z chipset for a server sounds nuts; however, hear me out. Intel Rapid Storage Technology is certainly usable by a server (especially a low-end server) when you have an SSD (used as cache) and a RAID boot array. Also, you can completely forgo a discrete graphics card altogether. It's also a mere $109.99 at Newegg. Alternative - BIOSTAR TZ77B (6-phase PWM, vs. 8-phase PWM in the TZ77A, and $20 less at Newegg).

RAM - TEAM 16 GB (4GB x4) DDR3-1333 - Sandy Bridge can't normally use faster-speed memory than DDR3-1333 - in fact, it will actually underclock it in normal operation; why pay more for a faster speed you will never use? Hence my going bargain here - $69.98 at Newegg (use promo code EMCNFHF44 by April 30th to save an additional fifteen percent)

Secondary Ethernet - Intel EXPI9301 PCIe X1 gigabit adapter - Surprisingly, Intel gigabit is cheaper standalone than at the PHY level, and this is as solid (and as inexpensive) as Intel gigabit gets. $29.99 at Newegg.

Storage (internal SSD) - SAMSUNG 830 Series 64GB 2.5" SSD - When it comes to SSDs, there's Samsung, Intel - and everyone else. If Intel is too pricey, then Samsung is your only real choice. $104.99 at Newegg (MZ-7PC064B/WW)

Storage (RAID) - Western Digital Caviar Green WD15EARS x2 - These are the non-IntelliPower members of the Caviar Green family in this size (1.5 TB each) - $219.98 for the pair at Newegg.

OS - Windows Server 8 beta - The beta version of Microsoft's next Windows Server (Windows Server 2012); thus perfect for a lab. Cost - none (download from Microsoft TechNet or MSDN).

In a proper DC setup you do..

ETH1 ETH2

Modem -------- > DC ---------> Switch/Router

This way my DC acts also as a firewall.

Virutalbox (VMWare) isnt the same thing.

no you don't. the dc belongs behind the switch/router. The only time that you would have something that assinine is if you had a proxy server (isa server or forefront server). For a proper dc setup 1 network card is more than enough. I have been setting up proper Domain Controllers for years and I have never ever done or seen anything like this.

You can pick up a cheap supermicro server and do what you need to. dual nics is more for redundancy than anything else, if one nic fails the other is there to continue on. This is known as nic teaming. Nic teaming is the proper way to setup a DC, plugging the nics into two different switches so that even if a switch fails completely the other switch still has access to the dc. It is about redundancy not whatever you did there. The DC does not act as a firewall, it is not meant to and this creates a security risk by putting your user db on the outside of the firewall...might as well give the hacking community the keys to your house too.

no you don't. the dc belongs behind the switch/router. The only time that you would have something that assinine is if you had a proxy server (isa server or forefront server). For a proper dc setup 1 network card is more than enough. I have been setting up proper Domain Controllers for years and I have never ever done or seen anything like this.

You can pick up a cheap supermicro server and do what you need to. dual nics is more for redundancy than anything else, if one nic fails the other is there to continue on. This is known as nic teaming. Nic teaming is the proper way to setup a DC, plugging the nics into two different switches so that even if a switch fails completely the other switch still has access to the dc. It is about redundancy not whatever you did there. The DC does not act as a firewall, it is not meant to and this creates a security risk by putting your user db on the outside of the firewall...might as well give the hacking community the keys to your house too.

Im not sure what you understood so Ill put it downwards.

(Internet)

|

|

|

[MODEM]

|

|

|

|

V

[DC]

|

|

|

|

V

[sWITCH/ROUTER]

|

|

|

|

V

[PC]

I need dual NICs to control (or analyze if you might want to call it like that) what comes into the network (from external sources) to what comes out ONTO the network (the switch/router). Since there are only 2 possible PCs here that can connect to a domain, Ill trust everything inside the network.

Let me put it to you like this. Your dc has a trusted and untrusted interface. Your dc with your AD database that includes your user information in the SAM, passwords as well as usernames, group info, share rights, etc...and you are OK with this? This is about as secure as leaving your car running, keys in the ignition, door wide open, in the bad area in town with your pants around your ankles and a sign asking for a guy named bubba to come and ram a stick in your rear then take your car.

If you want it to be secure, dc behind the firewall, and a forefront threat management gateway server to handle your traffic monitoring with 2 nics for an unsecure and secure side. That is the proper way to do it, Microsoft wise. The forefront server becomes the firewall, not the DC.

For a lab-type DC, here's the spec skinny (my take):

CPU - Intel Core i5 (LGA1155) - Quad-core makes way too much sense for any sort of domain controller (even one for a micro-domain); however, you don't need HT for a lab-based DC (and you wouldn't overclock a server, let alone a DC, therefore no K-series). Safe bets - i5-2300 or i5-2310 (either is $179.99 @ Newegg)

Motherboard - BIOSTAR TZ77A - A Z chipset for a server sounds nuts; however, hear me out. Intel Rapid Storage Technology is certainly usable by a server (especially a low-end server) when you have an SSD (used as cache) and a RAID boot array. Also, you can completely forgo a discrete graphics card altogether. It's also a mere $109.99 at Newegg. Alternative - BIOSTAR TZ77B (6-phase PWM, vs. 8-phase PWM in the TZ77A, and $20 less at Newegg).

RAM - TEAM 16 GB (4GB x4) DDR3-1333 - Sandy Bridge can't normally use faster-speed memory than DDR3-1333 - in fact, it will actually underclock it in normal operation; why pay more for a faster speed you will never use? Hence my going bargain here - $69.98 at Newegg (use promo code EMCNFHF44 by April 30th to save an additional fifteen percent)

Secondary Ethernet - Intel EXPI9301 PCIe X1 gigabit adapter - Surprisingly, Intel gigabit is cheaper standalone than at the PHY level, and this is as solid (and as inexpensive) as Intel gigabit gets. $29.99 at Newegg.

Storage (internal SSD) - SAMSUNG 830 Series 64GB 2.5" SSD - When it comes to SSDs, there's Samsung, Intel - and everyone else. If Intel is too pricey, then Samsung is your only real choice. $104.99 at Newegg (MZ-7PC064B/WW)

Storage (RAID) - Western Digital Caviar Green WD15EARS x2 - These are the non-IntelliPower members of the Caviar Green family in this size (1.5 TB each) - $219.98 for the pair at Newegg.

OS - Windows Server 8 beta - The beta version of Microsoft's next Windows Server (Windows Server 2012); thus perfect for a lab. Cost - none (download from Microsoft TechNet or MSDN).

For a lab-type DC, here's the spec skinny (my take):

CPU - Intel Core i5 (LGA1155) - Quad-core makes way too much sense for any sort of domain controller (even one for a micro-domain); however, you don't need HT for a lab-based DC (and you wouldn't overclock a server, let alone a DC, therefore no K-series). Safe bets - i5-2300 or i5-2310 (either is $179.99 @ Newegg)

Motherboard - BIOSTAR TZ77A - A Z chipset for a server sounds nuts; however, hear me out. Intel Rapid Storage Technology is certainly usable by a server (especially a low-end server) when you have an SSD (used as cache) and a RAID boot array. Also, you can completely forgo a discrete graphics card altogether. It's also a mere $109.99 at Newegg. Alternative - BIOSTAR TZ77B (6-phase PWM, vs. 8-phase PWM in the TZ77A, and $20 less at Newegg).

RAM - TEAM 16 GB (4GB x4) DDR3-1333 - Sandy Bridge can't normally use faster-speed memory than DDR3-1333 - in fact, it will actually underclock it in normal operation; why pay more for a faster speed you will never use? Hence my going bargain here - $69.98 at Newegg (use promo code EMCNFHF44 by April 30th to save an additional fifteen percent)

Secondary Ethernet - Intel EXPI9301 PCIe X1 gigabit adapter - Surprisingly, Intel gigabit is cheaper standalone than at the PHY level, and this is as solid (and as inexpensive) as Intel gigabit gets. $29.99 at Newegg.

Storage (internal SSD) - SAMSUNG 830 Series 64GB 2.5" SSD - When it comes to SSDs, there's Samsung, Intel - and everyone else. If Intel is too pricey, then Samsung is your only real choice. $104.99 at Newegg (MZ-7PC064B/WW)

Storage (RAID) - Western Digital Caviar Green WD15EARS x2 - These are the non-IntelliPower members of the Caviar Green family in this size (1.5 TB each) - $219.98 for the pair at Newegg.

OS - Windows Server 8 beta - The beta version of Microsoft's next Windows Server (Windows Server 2012); thus perfect for a lab. Cost - none (download from Microsoft TechNet or MSDN).

Overkill for a pet project with only 2 clients.

Why did you even ask for help if all you are doing is arguing?

:/ Im not arguing. PGHammer's specs were WAY over the line/budget for a simple physical test. Ive player around with a Virutalbox but it is not the same. sc302 misunderstood me in the first post he made and now I read his second (did not notice it)

Thanks to all for the help.

I suppose one of the questions is what version of Windows are you using for the AD? If it's windows 2003 you could get by on a P4 and 512MB RAM, if it's Windows 2008R2 you'll need a 64bit processor and 1GB RAM, that is if all your doing is AD, you've only got a couple of potential machines connecting to it so your not going to tax it. So really any processor you buy will be fine, as it's a pet project just buy the cheapest machine you can.

Also in a production environment i wouldn't have the domain controller connected directly to anything apart from the switch with one nic, two if you want fall over.

You can use any old PC hardware for just an AD. I run my home network on an Intel Atom and this runs a Linux VM, AD/DNS/DHCP, file serving and a PS3 media server. The only thing it doesn't do that well at is the PS3 media server when it has to re-encode a big file on the fly.

I agree with sc302 with the double NIC thing. You don't want to be exposing your AD to the external web. Suppose instead you could do a ESXi setup but I would guess the network routing configuration would be complicated to say the least.

Let me put it to you like this. Your dc has a trusted and untrusted interface.

By interface, I understand (once again) 2 NICs....

Your dc with your AD database that includes your user information in the SAM, passwords as well as usernames, group info, share rights, etc...and you are OK with this?

This implementation will not be a production area. It will be at my home with 2 PCs that contain nothing "important" to the public eye.

This is about as secure as leaving your car running, keys in the ignition, door wide open, in the bad area in town with your pants around your ankles and a sign asking for a guy named bubba to come and ram a stick in your rear then take your car.

Vast exaggeration. The car is not running because you need a password to run it. The door may be unlocked but the town only has about 10 citizens, none what so ever tech orientated (all the wifi signals in my neighboorhood are WEP :laugh: ) so there is no bubba, no sign, and no stick.

Would I even consider implementing a system like this in a production system? No way. I would consider my options (obviously you have given great advice so thank you) and then implement it another way.

If you want it to be secure, dc behind the firewall, and a forefront threat management gateway server to handle your traffic monitoring with 2 nics for an unsecure and secure side. That is the proper way to do it, Microsoft wise. The forefront server becomes the firewall, not the DC.

So your setup would be something like { Things in () are software/non existing/virtual/etc components and things in [] are hardware components } :

(Internet)

|

|

|

[MODEM]

|

|

|

|

V

(Firewall)

|

|

|

|

V

[DC]

|

|

|

|

V

[sWITCH/ROUTER]

|

|

|

|

V

[PC]

There is something a bit bugging me which maybe is my fault of lack of knowledge. On the DC, I can simply put a firewall for incoming connections and on the switch/router (which runs DD-WRT) I can put another firewall, making the DC be in a DMZ zone. I THINK what you are trying to get it is using another piece of equipment before the DC to use as a more secure firewall, which obviously is not the topic at hand :)

After all this conversation (and of course learning a thing or two), lets stick to the topic: Building a PC to be used as a Active Directory domain controller. Lets forget about security, setup, etc. for now. I just want to build a PC to be used as a Active Directory domain controller (hence why in the hardware section of Neowin)

The most I want out of this PC is probably getting the clients on the domain and Group Policy. After that, I really don't want much else out of it. Thats why it has to be budget :)

no you don't. the dc belongs behind the switch/router. The only time that you would have something that assinine is if you had a proxy server (isa server or forefront server). For a proper dc setup 1 network card is more than enough. I have been setting up proper Domain Controllers for years and I have never ever done or seen anything like this.

You can pick up a cheap supermicro server and do what you need to. dual nics is more for redundancy than anything else, if one nic fails the other is there to continue on. This is known as nic teaming. Nic teaming is the proper way to setup a DC, plugging the nics into two different switches so that even if a switch fails completely the other switch still has access to the dc. It is about redundancy not whatever you did there. The DC does not act as a firewall, it is not meant to and this creates a security risk by putting your user db on the outside of the firewall...might as well give the hacking community the keys to your house too.

All of this is correct, you don't need 2 NICs for a DC unless like he says you are worried about redundancy... I am not sure why you would put a DC between your Modem and Router. The only box that should be there in a normal network if you are using one would be a Proxy/Firewall system...

I suppose one of the questions is what version of Windows are you using for the AD? If it's windows 2003 you could get by on a P4 and 512MB RAM, if it's Windows 2008R2 you'll need a 64bit processor and 1GB RAM, that is if all your doing is AD, you've only got a couple of potential machines connecting to it so your not going to tax it. So really any processor you buy will be fine, as it's a pet project just buy the cheapest machine you can.

Also in a production environment i wouldn't have the domain controller connected directly to anything apart from the switch with one nic, two if you want fall over.

Well Im going to start with Windows Server 2008 R2 but once released, Ill go with Windows Server 2012. This means that (at beta time) the min requirements will be a 64 bit processor running at least 1.4 GHz, 512 MB of RAM, and at least 32GB of free space. Obviously, a bit more is needed as min requirements are not always the best and I may mess around with our things as well (Exchange servers, DNS/DHCP, etc) in the future.

You can use any old PC hardware for just an AD. I run my home network on an Intel Atom and this runs a Linux VM, AD/DNS/DHCP, file serving and a PS3 media server. The only thing it doesn't do that well at is the PS3 media server when it has to re-encode a big file on the fly.

I agree with sc302 with the double NIC thing. You don't want to be exposing your AD to the external web. Suppose instead you could do a ESXi setup but I would guess the network routing configuration would be complicated to say the least.

Pretty much same as above :)

Honestly for just a domain controller, I would keep the hardware specs to the minimum requirements for Windows Server or slightly above. If the machine will act solely as a DC (and maybe some small file storage), then it will only be handling authentications, which takes up almost no system resources.

I have servers at work using 2.4Ghz Athlon 64's with 512MB ram running Server 2003R2 that function as domain controllers for 50+ users easily.

I got this cheap list (cheapest products unless it was a nobrand vs a brand and the cost was min):

Gigabyte GA-H61M-DS2 41 euros

Intel Dual Core G620 2.6Ghz Box Socket 1155 53 euros

WD Caviar Blue 250GB SATA3 62 euros

Kingston ValueRAM 4GB DDR3 1333 PC3-10600 CL9 23 euros

Sony AD-5280S-0B DVD-RW 24X Black OEM 16.50 euros

Cooler Master Elite 342 MicroATX 27 euros

B-Move PSU 450W 17.95 euros

Total: 240.45 euros

I can cutdown to 2GB on the RAM and on the case....

The only thing you want is for the OS hdd to be raided in a mirror so that if one hdd dies you still have the other as a backup.

If your using 2008 or 2008 r2 i also advise an external hdd to be used as a backup drive for windows server backup.

Thats what I would recommend for a domain controller.

Why can't you understand that you don't need two NICs. One will be sufficient.

OK, then I guess, since we continue to make the software side a issue, we will have this setup:

(Internet)

|

|

|

[MODEM]

|

|

|

|

V

[sWITCH/ROUTER (Firewall)]

| |

| |

| |

| |

V V

[PC] [DC]

The only thing you want is for the OS hdd to be raided in a mirror so that if one hdd dies you still have the other as a backup.

If your using 2008 or 2008 r2 i also advise an external hdd to be used as a backup drive for windows server backup.

Thats what I would recommend for a domain controller.

Once again, this is not a production system. If the HDD dies, Ill just simply send it back, get a replacement, and reinstall.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • You've tried DuckDuckGo and Brave Search, now get serious with SearXNG by Paul Hill Over the last decade, it has become quite trendy to dump Google Search in favor of privacy-preserving alternatives such as DuckDuckGo, Startpage, and Brave Search. These search engines have done a very good job at highlighting dodgy practices by Google, such as adjusting search results based on what it thinks you’ll like (filter bubble) and stalking you around the web to advertise to you. While these search engines are good starting points when compared to non-private services like Google, there are still quite a few issues with them. For example, both DuckDuckGo and Brave Search require running non-free JavaScript in your web browser, which is comparable to running proprietary software on your computer, meaning you can be sure about what it’s actually doing in the background. Another issue is that these search engines are hosted on the respective companies’ servers, and you are using a service that you don’t control. Finally, DuckDuckGo, while offering privacy features, relies heavily on Microsoft’s infrastructure for its results and, in the past, has permitted Microsoft tracking scripts. If you are looking for a more private search solution than DuckDuckGo, Brave Search, and Startpage, then I recommend taking a look at SearXNG. It is a privacy-respecting metasearch engine that can be used via different public instances, which is useful for mobile users, or you can install it on your computer or server and run it locally with maximum control. Unlike Google, Bing, or Brave Search, which crawl the web and have their own search indexes, SearXNG is a metasearch engine, meaning it taps other search engines, stripping your identifying data, such as IP address, user agent, and cookies, in the process. Your search query is sent to the other search engines you enable before aggregating the results. SearXNG has deployment flexibility. If you are a casual user or a mobile user and don’t want to run SearXNG locally, you can use a public instance that is hosted by someone else. The main problem with this is that you are putting trust in the maintainer of the instance regarding stuff like logs that they may keep; good hosts should have a privacy policy explaining their policies. If you are trying to use SearXNG, you can also install the software on your device and then head to 127.0.0.1:8080 in your browser and search from there. While you don’t have to worry about a third-party admin like the public instances, search engines could ultimately block your IP address if they frown on you pulling in their search results locally. If you want to run it locally, it’s a good idea to use proxies or VPNs to hide your actual IP. You don’t have to worry about this with a public instance, as search engines never see your IP address. The main privacy benefit of using SearXNG is that it isolates your identity from the underlying engines that it’s capable of searching, such as Google and Bing. These search engines will only see requests coming from a generic server, so they can’t profile you and create a bubble filter that influences what results you see. This also ensures that your search engine doesn’t turn into an echo chamber that prevents you from reading alternative points of view. As a free software project, you are allowed to inspect SearXNG to make sure there are no negative features bundled inside. This sets it apart from the privacy search engines mentioned earlier because you can’t check their source code. As a meta search engine, you are not restricted to getting results from one source. Due to the fact that it scrapes content from other websites, your SearXNG instance will periodically get blocked from different providers, so it’s good to select a range of sources as a backup. While enabling all of the services will give you great results, this can make searching slower. I am personally happy with slower searches for the best results, but you can always check which providers are slowing down your search from the search results page and disable them to speed things up. If you want decent results quickly, enable the main search providers such as Google, Brave, DuckDuckGo, Qwant, Bing, and Yahoo. This way, you get wide coverage without the latency. On the Engines tab in Preferences, do note that there are different tabs, such as General, Images, and Videos, with their own providers that can be toggled and are not covered by "Enable all" while on the General tab, so be sure to dig into each. Just a note, if you want to enable everything, press "Enable all" in one tab, then hit save at the bottom of the page, then do the next tab, and so on. If you press "Enable all", then do that in each tab, and then save, nothing will stick. When I had just some of the search engines enabled, I searched “define nefarious” and results came back with the definition of “define” - obviously that was a sucky result. However, when I had everything enabled, it found dictionary pages for the word “nefarious” and even had an inline definition on the sidebar, which is quite nice too - that was delivered by WolframAlpha for anyone wondering! Probably the worst thing about this meta search engine is that the engines you select are saved with a cookie, so you must enable them on every new device you use SearXNG on, including if you decide to go into incognito mode with your web browser. Honestly, I would say this is the most annoying aspect, and perhaps if your browser lets you choose a separate private browsing search engine, then it would be best to use DuckDuckGo for this portion of your browsing. Another weakness of SearXNG is the random blocking of it by search providers. When you are on the results page, expand the “Response time” box, and it will show things like “Suspended: too many requests” or “access denied”. This is why it is good to enable several providers so that there is always a fallback to get results from. I won’t pretend SearXNG will be for everyone, however, if you enable all of the providers and put up with the slower response time, the results can be really amazing. Even if you don’t want to use it as your daily driver, keeping a bookmark handy that links to it is a good idea if you ever feel like doing a deep dive into a niche topic where other search engines are just failing to bring up any good result, due to the amount of sources it looks on. If you’re interested in radical user control over the software you use, installing SearXNG locally can also be a good idea, but be prepared to be temporarily blocked from sites if you trigger bot sensors without a VPN. Personally, I’ve opted to use a public instance, rather than install it myself. If you want to use it via a public instance, head over to searx.space to find a provider. Let us know in the comments if you have used SearXNG or its predecessor, Searx. What do you think about the quality of the results?
    • Dear Neowin, If it is not too much trouble, can you start using the new-ish designations for Insider Preview? "Experimental" is different than "former Dev" as it can apply to different models, eg 26H1 or 26H2 etc, right? No need to seed confusion IMHO. And, please "finally" update your graphics. OK?
    • Did you see their FAQ, its quite good. Have a look in the Advanced section. https://delta.chat/en/help
    • Just install Linux Mint that is a real blessing and many times cheaper because you can continue using your old Windows computer/laptop with the latest Linux updates.
    • Interesting share -- however it does not make sense: Email messages get stored somewhere, so how is Delta Chat "based on email" and decentralized without actually storing anything? By Web3 standard practices, the various Relays would require dedicated storage to make messages available to the recipients (like a large series of message queue channels, akin to racks of traditional post office boxes)... and Contacts must be two-way confirmed in order for encryption keys to be exchanged (ostensibly every key-pair is uniquely bound between sender and recipient) and the Relays would preserve the public keys in order to facilitate message carriage... or every device stores all sorts of keys and contact info. All of this to say, decentralized messaging is like running Bluesky nodes except instead of discovering/browsing public feeds by various posters (at the given node) these Delta Chats would be relaying encrypted messages (via Relays) that only trusted recipients would have the appropriate decryption key (their own private key) to read it. But this doesn't solve the "it's like email" sales pitch. The only way it's like email is that there's encrypted binary stuff being transported from your app into the federated ether of Delta Chat Relays for others to decrypt (hopefully only the intended recipient)... but outside of this federated relays framework, it is absolutely nothing like email.
  • Recent Achievements

    • Week One Done
      Woland13 earned a badge
      Week One Done
    • One Month Later
      Woland13 earned a badge
      One Month Later
    • One Year In
      bernmeister earned a badge
      One Year In
    • Week One Done
      Scoobystu earned a badge
      Week One Done
    • Week One Done
      tuben earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      503
    2. 2
      +Edouard
      226
    3. 3
      PsYcHoKiLLa
      158
    4. 4
      Steven P.
      75
    5. 5
      FloatingFatMan
      71
  • Tell a friend

    Love Neowin? Tell a friend!