VMs and DHCP

[tookawhile]

We have a very simple setup at the moment, just one domain, mycompany.com (I believe it should have been named local.company.com - can I this be easily rectified?)and all works fine.

My problems is this, we have a bunch of test PC's which are not allowed on the domain (in case our software goes crazy or something), so they end up in our default workgroup 'TEST'.

This has been all well and good in the past, but I've just allowed myself VPN access and when you enter browse the workgroup our 'TEST' group appears, this is Ok as long has nobody has allowed a share on any of the machines, but if they have, well you can see it and access (read only), as you have limited permissions settings on XP Pro as it is not in the domain. I wish to block this somehow.

I figured one of the following might solve the issue but I uncertain, they are:

1) Create a sub domain - test.mycompany.com and place the test PC's there?
2) Create a subnet under the existing domain?

I also have an additional problem with the Virtual Machines gobbling up IP addresses.

To complicate matters further, we have around 30 build/test/processing farm PCs, which we are trying to implement using VM technology, unfortunately this is causing DHCP issues.

Each time ATF launches a virtual machine instance to execute a test, the source
virtual machine is copied, and the copied machine is powered on. Although it
shares the same host name as its parent, each copied machine appears to the
DHCP server as a new machine and is allocated a new IP address. Over time,
under heavy use the pool of available IP addresses becomes exhausted and newly
created VMs are unable to connect to the network, preventing them from being
able to run the test.

One suggested solution to this may involve having all VMs on a
separate TEST domain that is trusted by machines on the MAIN domain. This
domain could have a separate DHCP server that has a different policy regarding
leasing of IP addresses: instead of an address being leased for 5 days (as is
the case at the moment) the time could be shortened so that addresses become
available for reuse as soon as the VM has shut down.

I tried adding a vendor class to the DHCP options (I can set a vendor ID in the VM config file) bit it didn't seem to work.

Can I have 2 DHCP servers on the same network if the domains are different?

 

[ITPangaeaArchitect]

We have a very simple setup at the moment, just one domain, mycompany.com (I believe it should have been named local.company.com - can I this be easily rectified?)and all works fine.

A: mycompany.com is perfectly fine. If you have a public website with the same name however, you will need to make static HOST records for the site name inside of the DNS zone for your domain (forwarding will not work since the DC/DNS server for the domain will be authoritative for the zone).



This has been all well and good in the past, but I've just allowed myself VPN access and when you enter browse the workgroup our 'TEST' group appears, this is Ok as long has nobody has allowed a share on any of the machines, but if they have, well you can see it and access (read only), as you have limited permissions settings on XP Pro as it is not in the domain. I wish to block this somehow.

I figured one of the following might solve the issue but I uncertain, they are:

1) Create a sub domain - test.mycompany.com and place the test PC's there?
2) Create a subnet under the existing domain?

A: Standalone PCs (or workgroup members such as those in TEST) have a single labeled name/NetBIOS name only. They do not append a DNS suffix by default. Option 1 therefore would end up to potentially be too much overhead, as you would have to set the DNS suffix for the connection on each system, point it to the DC for DNS (ensuring the zone you made is set to allow non-secure and secure dynamic updates), and then theoretically you could register...there is a quirk...you may have to enable anonymous access via user rights assignment to the DC, which is not a good idea. This is because the security of the OS is dropped tremendously. In addition, secure channel and SMB signing being required would no longer be an option...
Option 2 will gain no value for you. The purpose of subnet/site affiliation in AD is for site based referrals, i.e., a client in a subnet attached to site A will always look to site A first for a DC or DFS server.

I think the easiest option here, if possible, is to disable file and printer sharing. You can also use a combination of local group policy settings to lock the systems down more.

Not sure about your VM issue...if VMWare I know nada, if Virtual Server I maybe can help


Can I have 2 DHCP servers on the same network if the domains are different?

A: Yes and no. The DHCP servers will need to be segmented by a router that has DHCP relay disabled. This should help to control rogue DHCP operations. Throwing them onto the same segment will result in hit or miss IP allocation (where network traces would show NACKs for the failures)

Hope this helps



-Brandon Wilson
MCSE00/03, MCSA:Messaging00, MCSA03, A+
Manager - Global AD Operations
ACS, Inc.