Is a domain setup at home really worth it over SBS2011?

Forums › Microsoft Windows › Is a domain setup at home really worth it over SBS2011?

timbosan

2159 posts

Uber Geek

#150961 9-Aug-2014 10:45

Recently I upgraded from my SBS2011 server to Server 2012R2 (Standard with the Essentials role), along with SBS2011 (for on site Exchange). I has SBS2011 running for a while with no issues, but upgraded for a few reasons:

SBS2011 is an older product based on Server 2008, and 2012R2 offers improved performance
2012R2 includes Hyper-V and I now have a few VM's (SBS2011 can only address 8GB of RAM)
I wanted on site Exchange (both to move away from gmail etc, but also as a learning exercise)
I wanted to setup BES for my Blackberry (this runs in a VM along with SQL Server in another VM)

However I have a few issues and wondered if anyone could help.

1) Domain logins - as part of the move the main change was from a workgroup setup to a domain, however my iMac has real issues logging into the domain. Now I get constant errors (trust relationship errors like http://support.microsoft.com/kb/162797 )
2) Windows Updates via WSUS - I have a Windows 8.1 laptop that just doesn't get updates from WSUS no matter what I do

Are these 'normal' issues for running a domain? I am thinking of reverting back to WHS2011 for the file shares, and keeping SBS2011 for just Exchange and SharePoint, and not bothering with the AD part.

1101

3122 posts

Uber Geek

#1106878 12-Aug-2014 09:49

WSUS is nothing but a pain in the *ss . You would be surprised how many SBS2003 networks simply stopped doing any WinUpdates
on server & workstations after MS put through an update to the WSUS software.

I had the same issue Win Win8 & SBS2011 . It also caused issues when Win8 needed to use WinUpdate to download a driver (eg for printers)

To sort this out properly means reconfiguring Wsus, Group Policies etc. And then constantly check things as
MS may put out a patch/update that simply breaks it , needing reconfiguration, again.

or
copy below into a txt file, rename to .reg & run it on the Win8 pc
reboot , go into Winupdates & change the settings .

Windows Registry Editor Version 5.00
[-HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]

timbosan

2159 posts

Uber Geek

#1106879 12-Aug-2014 09:56

Ironically, after posting this I have come across another problem - the amount of disk space WSUS updates take up. It is already at 70GB and now the C: is full! And since it's a Vm with snapshots I have to merge the snapshots (not a quick thing to do) shut down the VM, expand the disk, and restart. I have for the time being turned off the Update Service and cleaned the WSUS folder.

1101 - Thanks for the info. I may just use SBS2011 for the email and SharePoint functionality. I am 50/50 on if I need the domain functionality. I can setup a WHS2011 box (effectively using it as a SAN) for all my shared files.

Final thing would be - would anyone recommend the 2012R2 remote access over the SBS2011? I currently have it setup so that I remote into the SBS2011 system, where I can access shared files, RDP etc. But I understand the 2012R2 functionality is far better? I assume just changing ports 80, 443 and 3389 on my modem is all I need to do?

wasabi2k

2096 posts

Uber Geek

#1106945 12-Aug-2014 11:14

timbosan: Ironically, after posting this I have come across another problem - the amount of disk space WSUS updates take up. It is already at 70GB and now the C: is full! And since it's a Vm with snapshots I have to merge the snapshots (not a quick thing to do) shut down the VM, expand the disk, and restart. I have for the time being turned off the Update Service and cleaned the WSUS folder.

1101 - Thanks for the info. I may just use SBS2011 for the email and SharePoint functionality. I am 50/50 on if I need the domain functionality. I can setup a WHS2011 box (effectively using it as a SAN) for all my shared files.

Final thing would be - would anyone recommend the 2012R2 remote access over the SBS2011? I currently have it setup so that I remote into the SBS2011 system, where I can access shared files, RDP etc. But I understand the 2012R2 functionality is far better? I assume just changing ports 80, 443 and 3389 on my modem is all I need to do?

Be selective in what WSUS downloads - select only updates needed by computers and only for products you use.

WSUS is perfectly fine - usual issue being people that don't know how to use it setting it up wrong.

Do some reading before opening random ports - the new stuff is pretty well documented.

Domain at home isn't worth it for 2 devices, no. Especially if one is a mac. However given you are using Sharepoint and Exchange you already have a domain - your clients just aren't joined to it.

Not to be rude but from the sounds of it this isn't something you manage/deal with every day - so unless you want to learn how all of this works I wouldn't bother.

ajobbins

5052 posts

Uber Geek

Trusted

#1106951 12-Aug-2014 11:16

How many mailboxes do you run on Exchange at home? I would be considering Office 365. A few bucks a month and you don't need to use your own hardware/power etc.

Twitter: ajobbins

toyonut

1508 posts

Uber Geek

#1107010 12-Aug-2014 12:29

What aspect of remote access are you wanting to use?
If it is direct access, you can only run it on enterprise windows 8/8.1 and need a certificate if you want windows 7.
If it is the RDP gateway or VPN, honestly, it is a bit easier with server 2008R2. Type of VPN is going to determine ports and protocols.

WSUS is fine, only download what you need and the size is managable. Deploy settings through group policy and it works lovely. It is complete overkill for one PC though.

Try Vultr using this link and get us both some credit:

http://www.vultr.com/?ref=7033587-3B

toyonut

1508 posts

Uber Geek

#1107916 13-Aug-2014 20:02

Just found today that you can set wsus to make clients download direct from MS. This should stop the local storage issue and still allow you to manage updates.

Try Vultr using this link and get us both some credit:

http://www.vultr.com/?ref=7033587-3B

nathan

5695 posts

Uber Geek
Inactive user

#1107954 13-Aug-2014 21:00

Exchange & SharePoint depend on AD, so it sounds like you need a DC unless you move both those workloads into Office 365 (that's what I'd recommend, but sounds like want the local install for training/learning)

Sharesies

Trade NZ and US shares and funds with Sharesies (affiliate link).

MadEngineer

4295 posts

Uber Geek

Trusted

#1107956 13-Aug-2014 21:03

ajobbins: How many mailboxes do you run on Exchange at home? I would be considering Office 365. A few bucks a month and you don't need to use your own hardware/power etc.

timbosan: but also as a learning exercise

You're not on Atlantis anymore, Duncan Idaho.

timbosan

2159 posts

Uber Geek

#1107964 13-Aug-2014 21:35

ajobbins: How many mailboxes do you run on Exchange at home? I would be considering Office 365. A few bucks a month and you don't need to use your own hardware/power etc.

Only 3, but as mentioned it is just as much for learning about all this stuff, and there seems to be lots to learn! I also like retaining ownership of my own data, hence I don't want stuff in the cloud.

timbosan

2159 posts

Uber Geek

#1107965 13-Aug-2014 21:36

paulmilbank: Just found today that you can set wsus to make clients download direct from MS. This should stop the local storage issue and still allow you to manage updates.

Sounds cool, do you have a link or info on how this works and how to set it up? Does it also work for Windows 8 clients?

timbosan

2159 posts

Uber Geek

#1107966 13-Aug-2014 21:39

nathan: Exchange & SharePoint depend on AD, so it sounds like you need a DC unless you move both those workloads into Office 365 (that's what I'd recommend, but sounds like want the local install for training/learning)

Yeah, the more I think about it, having an AD is not a bad thing, it just a new/different way of working, and not having had to deal with GPO's, GPE, WSUS, etc before, it is a steep learning curve, even with SBS2011 doing a lot of the work and only have a small LAN (about 6 machines and a couple of VM's).

Plus I had to set up an AD at some point as I want to try BES10, and that requires a domain. I have it installed, now I just need to set up the ports and link my Z10 to it.

toyonut

1508 posts

Uber Geek

#1107988 13-Aug-2014 22:04

In the wsus console,click on options from the selection on the left then click on update files and languages. There are options in there to restrict languages downloaded, download all updates locally or only the ones approved, on download approved updates direct from MS without storing locally.
Also in the options, you can find the products and classifications to download. Only tick what is on your network, if you aren't using it, don't download updates for it.

Try Vultr using this link and get us both some credit:

http://www.vultr.com/?ref=7033587-3B

MadEngineer

4295 posts

Uber Geek

Trusted

#1108674 14-Aug-2014 21:17

you also need to set your clients (policy) to use wsus. it doesn't just happen.

You're not on Atlantis anymore, Duncan Idaho.

timbosan

2159 posts

Uber Geek

#1108909 15-Aug-2014 11:21

MadEngineer: you also need to set your clients (policy) to use wsus. it doesn't just happen.

But doesn't this happen auto-magically if you join the domain? (Except maybe on Windows 8 client on SBS2011, which seems to be a problem still)

wasabi2k

2096 posts

Uber Geek

#1108932 15-Aug-2014 11:51

timbosan:
MadEngineer: you also need to set your clients (policy) to use wsus. it doesn't just happen.

But doesn't this happen auto-magically if you join the domain? (Except maybe on Windows 8 client on SBS2011, which seems to be a problem still)

Only if there are pre built GPOs that configure it.

Otherwise no. There is no magic.