mson's questions

I strongly dislike antivirus software. In my opinion, the av software behaves much like a virus. The recent Symantec incident of actually causing server crashes, resource use, software interference, and user safety bias are each very problematic.

If I have locked down servers behind a firewall, with admins following security protocol (no surfing, no downloads, etc.). What benefit would I have from installing antivirus software on these machines? I must install something for insurance purposes...

When i researched AV products a few years ago, the coverage was 95% at best - and these are of known security issues. That means that the best AV protection is vulnerable to thousands of known viruses and worms.

Every single infection I have encountered has been on a machine with AV software on it. The user always says - but I have antivirus software...

Can anyone provide metrics on the utility of av software on servers that will make me feel better about having to do it?

I'm setting up an active directory/domain controller that is also doing DNS using Windows Server 2008 R2.

The install went smoothly. I am able to add a computer to the domain, and can even connect to the internet from this workstation. However, I cannot connect to the internet from the actual domain controller (I'm trying to run windows updates).

Can anyone provide some guidance?

Thanks!

So, I'm cheap and I buy tower servers instead of blades. I was thinking of getting a workstation for my servers, but came across some industrial shelving. The shelving is metal and is capable of holding 3000 pounds. The potential concern I have is that the shelving is on wheels (but they lock) and that the shelves are wired and not flat.

Does anyone have any input on using these shelves as a rack for about a dozen servers?

For windows server 2008, is there an easy way to put the server name in the background wallpaper?

I'd like it to display SERVER-A, SERVER-B etc...

I'd prefer not to buy anything or generate images.

I've always disliked the godaddy user experience and their mail performance has caused hours of grief for our technical people. Now that they've released their latest batch of sleazy commercials, upper management is on board with us switching providers.

Can someone recommend a socially responsible provider for hosted domains and email?

Thanks in advance.

I'm shopping a dell machine and wanted to know what the experts thought about the value aded by getting an upgraded NIC. I've got cat6 throughout network and gigabit routers.

On-Board Single Gigabit Network Adapter [Included in Price]

Intel® PRO 1000PT 1GbE Single Port NIC, PCIe-1 [add $139]

Intel® PRO 1000PT 1GbE Dual Port NIC, PCIe-4 [add $199] Dell Recommended May delay your PowerEdge T100 ship date

Broadcom® 5722 1GbE Single Port NIC, PCIe-1 [add $59]

Broadcom® 5708 Single Port 1GbE NIC w/TOE PCIe-4 [add $99]

Broadcom® 5708 Single Port 1GbE NIC w/TOE iSCSI, PCIe-4 [add $99]

Do the intel or broadcom nics perform better than the onboard? I'm using the servers for app servers/db servers/dcs. OS - windows server 2008 standard

EDIT:

The servers are xeon quadcore with 8gb ram and 7200rpm drives. They will be used for dc, sql server, iis.

It used to be recommended that the Domain servers house no other functionality.

The CEO and outside IT firms keep bringing up that they would like to use these servers for additional functions - like FTP/Mail/etc.

Has security improved to make such a scenario ok? I'm not surprised by the CEO's suggestion, but I'm surprised that external IT firms would suggest such a thing. Am I that behind the times?

Compromise of the Domain servers seems so serious that I keep these machines completely locked down.

EDIT - THANKS FOR RESPONSES

It sounds like things haven't changed and nothing should be installed on DCs. I'm really puzzled by the external IT organization suggestions. They were all suggesting that this was ok.

The old school of thought was that application and database servers should not be part of the domain. I have my network setup such that only the app servers can communicate with the db servers. The app servers are in their own workgroup and the db servers are in their own workgroup. The servers are completely isolated from the rest of the network and developers get access via vpn/rdp. Is this still a good way setting up the infrastructure?

The reason I ask is that I'm finally updating the environment with Active Directory and there is a window to redesigning the network architecture if it is appropriate.

I'm not really a sys admin, but need to fulfill the role...

EDIT

I really appreciate everyone's patience and assistance. I know very little about Active Directory. My main concern is that a user machine will be compromised (zombie) and that this compromised machine could be used to access production servers via AD. Using AD would make my life a lot easier, but a single compromise would devastate the company. Right now, there is very little possibility of an unauthorized user getting access to internal production servers.

In any event, it seems that the consensus is that AD does not add risk to production servers and it is a generally acceptible practice to do so. So, I suppose I should start ramping up in my knowledge of AD and correct setup or see if there is a local expert who can do this.

Thanks for all the info.

I'm looking at getting a few additional servers. Can someone enlighten me as to which I should prefer based on the following uses?

Active Directory/DNS Server (<50 users):

1. Dual Core Intel® Xeon® E3120, 3.16 GHz, 6MB Cache, 1333MHz FSB
2. Quad Core Intel® Xeon® X3220, 2.40GHz, 2x4M Cache, 1066MHz FSB

Sql Server 2008 DB Server:

1. Dual Core Intel® Xeon® E3120, 3.16 GHz, 6MB Cache, 1333MHz FSB
2. Quad Core Intel® Xeon® X3220, 2.40GHz, 2x4M Cache, 1066MHz FSB

Thanks in Advance

fyi - the price point of the processers is the same the systems will be windows server 2008 with 8GB RAM and 2 250GB 7200RPM Drives

EDIT:

It seems that either machine could handle the DC role and the quad core was somewhat better suited for the db role. I've decided to get 4 quadcores just because there is something to be said for having identical equipment (for rebuilding/backup server/etc.)

Thanks for all the useful feedback.