Hello all,

Before I get to babbling on, please feel free to correct
me if I'm wrong at any point, and please forgive the
massive long post for such a simple queery!

I'm in the process of designing the infrastructure for
when we move to Win2k network/domain.
I'm not very experianced in IIS and was looking for some
advice.
One problem is our current NT Domain name is no longer
relevant to the company, and so we want to tidy it up from
a user perspective (logging on from internet). So our
upgrade strategy includes moving to a new domain name of
fashion.com. Unfortunatly NT/2k logon uses netbios for
domain names, so our users would still have to use our old
domain name. What I did discover is if IIS sits on a
Domain Controller then there's no need no put a domain
name in when logging on. However whilst having a quick
browse through the jungle that is Microsoft.com I came
across a statement that IIS and DC on the same box can
cause replication issues, and put a heavy load on the
server.

Now to the point.
There are a few ways of implementing IIS, but what are the
pros and cons of having IIS sat on Domain Controller, or a
member server, or in a different forest etc???
Are there any standard practices you could reccommend?

Thanks for reading all this, any help is appreciated!

[quoted text, click to view]

Is your primary concern the ability for user to logon without typing the
domain? If so, just set the default domain ...
http://support.microsoft.com/?kbid=168908

--
Tom Kaminski IIS MVP
http://www.iistoolshed.com/ - tools, scripts, and utilities for running IIS
http://mvp.support.microsoft.com/
http://www.microsoft.com/windowsserver2003/community/centers/iis/

In article <06b301c39c88$730bbbe0$a501280a@phx.gbl>,
matt.rowe@quantumclothing.com says...
[quoted text, click to view]

NEVER INSTALL IIS ON A PUBLIC BOX THAT IS A MEMBER OF YOUR DOMAIN.

Your IIS box should sit in an isolated network (DMZ) and be fully
protected by a firewall. It should NOT be a domain controller, unless it
acts as it's own domain and has NO connection to your local
network/domain.

If you want to use authentication, then do so through the web
application, not through NT user accounts. In other words, if your site
is providing user services, have them log into an application where
their user/pws is checked against a database table (or xml file) and not
with the OS.

If you put your site on a DC that sits in your local network you are
going to get compromised - esp. if you let users have real network
accounts.

I say this after having managed and designed thousands of IIS sites and
never having had any of them compromised, but I've seen other designers
sites hacked before they were done installing them.



--
--
spamfree999@rrohio.com

[quoted text, click to view]

Agreed. Putting IIS onto a domain controller might be acceptable IF you are
a small organization with not a lot of money for extra servers, and the
server is not visible from the Internet, and keeping the server secure from
internal users is not a big concern for you.

In article <OGqWZ3TnDHA.2488@TK2MSFTNGP12.phx.gbl>,
levinson_k@despammed.com says...
[quoted text, click to view]

You can purchase a box with Windows 2000 Standard for about $1500 from
Dell. Think about how much down time and data loss you will have if you
are compromised because you went the CHEAP way?

I've installed Exchangee and ran the company HTML only website on a
single box, but the box sat in the DMZ and had no DMZ>LAN rules. The
server required authentication for email every time you accessed it, but
if it ever gets hacked they can't get back into the company LAN.

--
--
spamfree999@rrohio.com

On Mon, 27 Oct 2003 04:47:15 -0800, "Matt Rowe"
[quoted text, click to view]

Pros - Not really any. Cons - Plenty. From the replication issues
you mention, to the security aspect of running under a domain account
and so on.

[quoted text, click to view]

IIS on a stand-alone server, outside the firewall, for external
access. A separate internal IIS for intranet use. VPN's if users
need to connect from outside.

Oh, and fashion.com is taken.

[quoted text, click to view]

Agreed, though there are some organizations [think churches, non-profits,
small home offices, dentists offices, etc.] that may want to share files or
information via HTTP and can't afford $1500. MS Small Business Server is
relatively popular, even though [if I understand correctly] a typical SBS
configuration puts the firewall, email server and domain controller on the
same single server.

Give me a call, I think I know how to sort this out

From http://www.developmentnow.com/g/91_2003_10_0_0_363853/Pros-Cons--.htm

Posted via DevelopmentNow.com Groups