ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Where do I start with replacing the whole MS AD stack

    Scheduled Pinned Locked Moved Water Closet
    microsoftactive directoryaddhcpdns
    104 Posts 8 Posters 10.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DonahueD
      Donahue @JaredBusch
      last edited by

      @JaredBusch said in Where do I start with replacing the whole MS AD stack:

      @Donahue said in Where do I start with replacing the whole MS AD stack:

      its the device or user making the request to the DNS service.

      The only device making a request to the Windows DNS service is the other DNS server.

      let me rephrase this to make sure I understand what you are saying. Setup the router to act as the DNS server, with a forwarder to the windows DNS, as opposed to simply putting the windows DNS ip into the settings handed out by DHCP?

      DashrenderD 1 Reply Last reply Reply Quote 0
      • DashrenderD
        Dashrender @JaredBusch
        last edited by

        @JaredBusch said in Where do I start with replacing the whole MS AD stack:

        @Donahue said in Where do I start with replacing the whole MS AD stack:

        its the device or user making the request to the DNS service.

        The only device making a request to the Windows DNS service is the other DNS server.

        I think we all get that - but that non windows DNS server is a proxy for the users behind it.

        What @Donahue and @scottalanmiller are saying is that they don't believe the proxy actually protects them licensing wise - and that was my question way up top, though not worded as well.

        scottalanmillerS 1 Reply Last reply Reply Quote 1
        • DashrenderD
          Dashrender @Donahue
          last edited by

          @Donahue said in Where do I start with replacing the whole MS AD stack:

          @JaredBusch said in Where do I start with replacing the whole MS AD stack:

          @Donahue said in Where do I start with replacing the whole MS AD stack:

          its the device or user making the request to the DNS service.

          The only device making a request to the Windows DNS service is the other DNS server.

          let me rephrase this to make sure I understand what you are saying. Setup the router to act as the DNS server, with a forwarder to the windows DNS, as opposed to simply putting the windows DNS ip into the settings handed out by DHCP?

          Correct.

          1 Reply Last reply Reply Quote 0
          • scottalanmillerS
            scottalanmiller @JaredBusch
            last edited by

            @JaredBusch said in Where do I start with replacing the whole MS AD stack:

            @Donahue said in Where do I start with replacing the whole MS AD stack:

            its the device or user making the request to the DNS service.

            The only device making a request to the Windows DNS service is the other DNS server.

            Correct, but that's not the basis for the licensing requirement. Anything that uses that DNS downstream is getting it from an "agregator" to the Windows service and therefore needs the CAL.

            DashrenderD JaredBuschJ 2 Replies Last reply Reply Quote 0
            • DashrenderD
              Dashrender @scottalanmiller
              last edited by

              @scottalanmiller said in Where do I start with replacing the whole MS AD stack:

              @JaredBusch said in Where do I start with replacing the whole MS AD stack:

              @Donahue said in Where do I start with replacing the whole MS AD stack:

              its the device or user making the request to the DNS service.

              The only device making a request to the Windows DNS service is the other DNS server.

              Correct, but that's not the basis for the licensing requirement. Anything that uses that DNS downstream is getting it from an "agregator" to the Windows service and therefore needs the CAL.

              I tend to agree that MS will see it this way - and that Jared's workaround won't solve the CAL requirement.

              scottalanmillerS 1 Reply Last reply Reply Quote 0
              • scottalanmillerS
                scottalanmiller @Dashrender
                last edited by

                @Dashrender said in Where do I start with replacing the whole MS AD stack:

                @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                @Donahue said in Where do I start with replacing the whole MS AD stack:

                its the device or user making the request to the DNS service.

                The only device making a request to the Windows DNS service is the other DNS server.

                I think we all get that - but that non windows DNS server is a proxy for the users behind it.

                What @Donahue and @scottalanmiller are saying is that they don't believe the proxy actually protects them licensing wise - and that was my question way up top, though not worded as well.

                Correct. And Microsoft has stated this outright, it's not our interpretation, it is Microsoft's explanation of the license.

                Otherwise, you could claim any application talks to SQL Server and you don't need CALs because you don't talk to the database. or any number of abstractions.

                None of our users talk to DNS directly, it's always some other piece of software. If we could avoid CALs through that abstraction, we'd create them everywhere. In fact, you could say any VPN would do it. The number of exceptions would become crazy.

                1 Reply Last reply Reply Quote 0
                • JaredBuschJ
                  JaredBusch @scottalanmiller
                  last edited by

                  @scottalanmiller said in Where do I start with replacing the whole MS AD stack:

                  @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                  @Donahue said in Where do I start with replacing the whole MS AD stack:

                  its the device or user making the request to the DNS service.

                  The only device making a request to the Windows DNS service is the other DNS server.

                  Correct, but that's not the basis for the licensing requirement. Anything that uses that DNS downstream is getting it from an "agregator" to the Windows service and therefore needs the CAL.

                  If that is the actual term of theri license, then, yet another reason to move on to this with the target of getting to no AD agian.

                  DonahueD scottalanmillerS DashrenderD 3 Replies Last reply Reply Quote 1
                  • scottalanmillerS
                    scottalanmiller @Dashrender
                    last edited by

                    @Dashrender said in Where do I start with replacing the whole MS AD stack:

                    @scottalanmiller said in Where do I start with replacing the whole MS AD stack:

                    @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                    @Donahue said in Where do I start with replacing the whole MS AD stack:

                    its the device or user making the request to the DNS service.

                    The only device making a request to the Windows DNS service is the other DNS server.

                    Correct, but that's not the basis for the licensing requirement. Anything that uses that DNS downstream is getting it from an "agregator" to the Windows service and therefore needs the CAL.

                    I tend to agree that MS will see it this way - and that Jared's workaround won't solve the CAL requirement.

                    Most importantly, Microsoft and the courts have always seen it that way.

                    It is that you need licenses for every user that gets a benefit from the service, not every one that talks to it directly.

                    1 Reply Last reply Reply Quote 0
                    • DashrenderD
                      Dashrender
                      last edited by

                      Now you're looking at replacing DNS completely in the network to get away from this requirement. Setup a DDNS server on Fedora, make all your servers use it - no longer have AD integrated zones, bob's your uncle.

                      1 Reply Last reply Reply Quote 0
                      • DonahueD
                        Donahue @JaredBusch
                        last edited by

                        @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                        @scottalanmiller said in Where do I start with replacing the whole MS AD stack:

                        @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                        @Donahue said in Where do I start with replacing the whole MS AD stack:

                        its the device or user making the request to the DNS service.

                        The only device making a request to the Windows DNS service is the other DNS server.

                        Correct, but that's not the basis for the licensing requirement. Anything that uses that DNS downstream is getting it from an "agregator" to the Windows service and therefore needs the CAL.

                        If that is the actual term of theri license, then, yet another reason to move on to this with the target of getting to no AD agian.

                        agreed

                        1 Reply Last reply Reply Quote 0
                        • scottalanmillerS
                          scottalanmiller @JaredBusch
                          last edited by

                          @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                          @scottalanmiller said in Where do I start with replacing the whole MS AD stack:

                          @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                          @Donahue said in Where do I start with replacing the whole MS AD stack:

                          its the device or user making the request to the DNS service.

                          The only device making a request to the Windows DNS service is the other DNS server.

                          Correct, but that's not the basis for the licensing requirement. Anything that uses that DNS downstream is getting it from an "agregator" to the Windows service and therefore needs the CAL.

                          If that is the actual term of theri license, then, yet another reason to move on to this with the target of getting to no AD agian.

                          Well yeah, that's why keeping Microsoft off of the network completely is so important. It's a taint. once you let it in the door, it is essentially impossible to not have to license every single user (or device.)

                          1 Reply Last reply Reply Quote 0
                          • DashrenderD
                            Dashrender @JaredBusch
                            last edited by

                            @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                            @scottalanmiller said in Where do I start with replacing the whole MS AD stack:

                            @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                            @Donahue said in Where do I start with replacing the whole MS AD stack:

                            its the device or user making the request to the DNS service.

                            The only device making a request to the Windows DNS service is the other DNS server.

                            Correct, but that's not the basis for the licensing requirement. Anything that uses that DNS downstream is getting it from an "agregator" to the Windows service and therefore needs the CAL.

                            If that is the actual term of theri license, then, yet another reason to move on to this with the target of getting to no AD agian.

                            I don't think you need to be that dramatic.

                            You can manage two networks - one for Windows stuff - that's all licensed up, and another for everything else (or possibly two others - one corporate and one guest). the other networks of course would use non windows services to service devices/users.

                            DustinB3403D scottalanmillerS 2 Replies Last reply Reply Quote 0
                            • DustinB3403D
                              DustinB3403 @Dashrender
                              last edited by

                              @Dashrender said in Where do I start with replacing the whole MS AD stack:

                              @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                              @scottalanmiller said in Where do I start with replacing the whole MS AD stack:

                              @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                              @Donahue said in Where do I start with replacing the whole MS AD stack:

                              its the device or user making the request to the DNS service.

                              The only device making a request to the Windows DNS service is the other DNS server.

                              Correct, but that's not the basis for the licensing requirement. Anything that uses that DNS downstream is getting it from an "agregator" to the Windows service and therefore needs the CAL.

                              If that is the actual term of theri license, then, yet another reason to move on to this with the target of getting to no AD agian.

                              I don't think you need to be that dramatic.

                              You can manage two networks - one for Windows stuff - that's all licensed up, and another for everything else (or possibly two others - one corporate and one guest). the other networks of course would use non windows services to service devices/users.

                              Why? When he could just manage the one, and not deal with the licensing at all? Or to only provide MS licensing for things that "must run on windows" but not any services like DHCP or DNS.

                              1 Reply Last reply Reply Quote 2
                              • scottalanmillerS
                                scottalanmiller @Dashrender
                                last edited by

                                @Dashrender said in Where do I start with replacing the whole MS AD stack:

                                @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                                @scottalanmiller said in Where do I start with replacing the whole MS AD stack:

                                @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                                @Donahue said in Where do I start with replacing the whole MS AD stack:

                                its the device or user making the request to the DNS service.

                                The only device making a request to the Windows DNS service is the other DNS server.

                                Correct, but that's not the basis for the licensing requirement. Anything that uses that DNS downstream is getting it from an "agregator" to the Windows service and therefore needs the CAL.

                                If that is the actual term of theri license, then, yet another reason to move on to this with the target of getting to no AD agian.

                                I don't think you need to be that dramatic.

                                You can manage two networks - one for Windows stuff - that's all licensed up, and another for everything else (or possibly two others - one corporate and one guest). the other networks of course would use non windows services to service devices/users.

                                Can, but it is very difficult to do and a huge pain.

                                DashrenderD 1 Reply Last reply Reply Quote 1
                                • DashrenderD
                                  Dashrender @scottalanmiller
                                  last edited by Dashrender

                                  @scottalanmiller said in Where do I start with replacing the whole MS AD stack:

                                  @Dashrender said in Where do I start with replacing the whole MS AD stack:

                                  @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                                  @scottalanmiller said in Where do I start with replacing the whole MS AD stack:

                                  @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                                  @Donahue said in Where do I start with replacing the whole MS AD stack:

                                  its the device or user making the request to the DNS service.

                                  The only device making a request to the Windows DNS service is the other DNS server.

                                  Correct, but that's not the basis for the licensing requirement. Anything that uses that DNS downstream is getting it from an "agregator" to the Windows service and therefore needs the CAL.

                                  If that is the actual term of theri license, then, yet another reason to move on to this with the target of getting to no AD agian.

                                  I don't think you need to be that dramatic.

                                  You can manage two networks - one for Windows stuff - that's all licensed up, and another for everything else (or possibly two others - one corporate and one guest). the other networks of course would use non windows services to service devices/users.

                                  Can, but it is very difficult to do and a huge pain.

                                  It's not that difficult to setup two networks - but I'll agree it's a pain managing it, mainly because you have to manage it, not because it would be that difficult.

                                  DustinB3403D scottalanmillerS 2 Replies Last reply Reply Quote 0
                                  • DustinB3403D
                                    DustinB3403 @Dashrender
                                    last edited by

                                    @Dashrender said in Where do I start with replacing the whole MS AD stack:

                                    @scottalanmiller said in Where do I start with replacing the whole MS AD stack:

                                    @Dashrender said in Where do I start with replacing the whole MS AD stack:

                                    @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                                    @scottalanmiller said in Where do I start with replacing the whole MS AD stack:

                                    @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                                    @Donahue said in Where do I start with replacing the whole MS AD stack:

                                    its the device or user making the request to the DNS service.

                                    The only device making a request to the Windows DNS service is the other DNS server.

                                    Correct, but that's not the basis for the licensing requirement. Anything that uses that DNS downstream is getting it from an "agregator" to the Windows service and therefore needs the CAL.

                                    If that is the actual term of theri license, then, yet another reason to move on to this with the target of getting to no AD agian.

                                    I don't think you need to be that dramatic.

                                    You can manage two networks - one for Windows stuff - that's all licensed up, and another for everything else (or possibly two others - one corporate and one guest). the other networks of course would use non windows services to service devices/users.

                                    Can, but it is very difficult to do and a huge pain.

                                    It's not that difficult to setup two networks - but I'll agree it's a pain managing it.

                                    Of course it's a huge pane to setup dual networks. . .

                                    1 Reply Last reply Reply Quote 0
                                    • scottalanmillerS
                                      scottalanmiller @Dashrender
                                      last edited by

                                      @Dashrender said in Where do I start with replacing the whole MS AD stack:

                                      @scottalanmiller said in Where do I start with replacing the whole MS AD stack:

                                      @Dashrender said in Where do I start with replacing the whole MS AD stack:

                                      @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                                      @scottalanmiller said in Where do I start with replacing the whole MS AD stack:

                                      @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                                      @Donahue said in Where do I start with replacing the whole MS AD stack:

                                      its the device or user making the request to the DNS service.

                                      The only device making a request to the Windows DNS service is the other DNS server.

                                      Correct, but that's not the basis for the licensing requirement. Anything that uses that DNS downstream is getting it from an "agregator" to the Windows service and therefore needs the CAL.

                                      If that is the actual term of theri license, then, yet another reason to move on to this with the target of getting to no AD agian.

                                      I don't think you need to be that dramatic.

                                      You can manage two networks - one for Windows stuff - that's all licensed up, and another for everything else (or possibly two others - one corporate and one guest). the other networks of course would use non windows services to service devices/users.

                                      Can, but it is very difficult to do and a huge pain.

                                      It's not that difficult to setup two networks - but I'll agree it's a pain managing it, mainly because you have to manage it, not because it would be that difficult.

                                      It is most of the effort of running two companies and maintaining two skill sets. It is nearly a doubling of the effort of just running one.

                                      DashrenderD 1 Reply Last reply Reply Quote 0
                                      • DonahueD
                                        Donahue
                                        last edited by

                                        Ok, DHCP is switched over. It's currently just pointing the DNS to the existing DNS servers.

                                        JaredBuschJ 1 Reply Last reply Reply Quote 0
                                        • JaredBuschJ
                                          JaredBusch @Donahue
                                          last edited by

                                          @Donahue said in Where do I start with replacing the whole MS AD stack:

                                          Ok, DHCP is switched over. It's currently just pointing the DNS to the existing DNS servers.

                                          Right. Now you can work on setting up your DHCP reservation, and migrating all the static IP junk to reservations.

                                          Once that is done, you can work towards changing DNS.

                                          DonahueD 1 Reply Last reply Reply Quote 0
                                          • DashrenderD
                                            Dashrender @scottalanmiller
                                            last edited by

                                            @scottalanmiller said in Where do I start with replacing the whole MS AD stack:

                                            @Dashrender said in Where do I start with replacing the whole MS AD stack:

                                            @scottalanmiller said in Where do I start with replacing the whole MS AD stack:

                                            @Dashrender said in Where do I start with replacing the whole MS AD stack:

                                            @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                                            @scottalanmiller said in Where do I start with replacing the whole MS AD stack:

                                            @JaredBusch said in Where do I start with replacing the whole MS AD stack:

                                            @Donahue said in Where do I start with replacing the whole MS AD stack:

                                            its the device or user making the request to the DNS service.

                                            The only device making a request to the Windows DNS service is the other DNS server.

                                            Correct, but that's not the basis for the licensing requirement. Anything that uses that DNS downstream is getting it from an "agregator" to the Windows service and therefore needs the CAL.

                                            If that is the actual term of theri license, then, yet another reason to move on to this with the target of getting to no AD agian.

                                            I don't think you need to be that dramatic.

                                            You can manage two networks - one for Windows stuff - that's all licensed up, and another for everything else (or possibly two others - one corporate and one guest). the other networks of course would use non windows services to service devices/users.

                                            Can, but it is very difficult to do and a huge pain.

                                            It's not that difficult to setup two networks - but I'll agree it's a pain managing it, mainly because you have to manage it, not because it would be that difficult.

                                            It is most of the effort of running two companies and maintaining two skill sets. It is nearly a doubling of the effort of just running one.

                                            I do this right now for my guest network... and so does just about anyone else out there who have completely separate networks for guests.

                                            Is it crazy to do this for the corporate side - yeah I think so, but I also think percentage wise it's pretty low the amount of companies that have many times the number of employees compared to endpoint devices to the point where you wouldn't just CAL every user to even make this an issue.

                                            1 Reply Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 3
                                            • 4
                                            • 5
                                            • 6
                                            • 3 / 6
                                            • First post
                                              Last post