Need opinion on setting Win2000 network

[b4u]

Hi,

I need some opinion on how to correctly setup a Windows 2000 network. I'm no system expert, but I have successfully implemented such networks so far with success.

Here is what I'll have to implement:

1 Windows 2000 Server (P4 with 1Gb RAM)
1 Windows XP Pro Desktop Workstation (P4 with 1Gb RAM)
2 Windows XP Home Laptops
1 Network Printer Xerox Office WorkCentre M15

What am I thinking about doing:

Configure W2KServer as a domain (example: MYDOMAIN) and it would have AD, DNS, DHCP. Join every machine to the domain, and setup individual users on AD for individual accesses, as usual. There would be a central profile directory holder (on server), individual personal folders on server, and a central document/work folder.

The reason I'm doing this now, is because the last guy who did it configured the machines, never told people how to correctly use the functionalities, and so all network is a crap right now ... there are anti-virus installed everywhere, several products, several firewalls that seam to block each other, people stopped accessing the Xerox printer by some mis-configuration (printer just disappeared from config, and in one laptop, they cannot print anything, probably thanks to a firewall installed). So everything is a complete madness right now. Oh, and the desktop workstation just keeps crashing with a blue screen (wow!).

So I'm planning to do complete reformats and reconfig of the hole thing ... not before doing backup of thata, of course .

Now I need your opinion regarding some security measures. At the moment, there is an ADSL modem connected to the server via USB. The connection is shared across the network. Since I don't like this kind of config at all, I'm planning to change the modem to a router with adsl modem incorporated, and connect it directly to the switch. So, I'll get a more secure and easily shared internet for everyone ... I'll probably be able to use some king of hardware firewall on the router.

But what should I setup to help fighting virus and hacking attempts? I don't want to be worried every day about security on that network ... I would be happy if I could setup up an anti-virus on the server, that would update every day, and would update also every client connected to the domain ... so everything would work just fine, no need to install individual anti-virus packages on every computer. You know what I mean ... configure everything so I don'thave to worry about each individual user installing stuff on their computer ...

So, I need your opinions ... how would you think about setting up such a system?

Thanks

 

[ktwebb]

First thing to do, since your reformatting/reinstalling anyway, is to load Pro on all machines. You cannot add an XP home machine to a domain, so your GPO's, scripting through domain logins etc... are out the door if you stay with Home. For corporate A/V your looking at some pretty serious money. How much do you have to spend. There will someone coming along here that recommends a linux firewall and if your comfortable with linux that is certainly an option. Even if your not there are some fairly easy *nix firewall solutions out there.

 

[b4u]

Hi,

Thanks for the answer.

Well, how much I'm willing to spend? To be honest, I have to present a solution to the "boss" of that company, so I have to present a valid solution, with a price withing reasonable margins taking the network and business size into consideration.

I mean, I'll have to put my own hour cost into consideration, so I have to think about a solution.

Anyway, I would like to ear about every solution you can think of, at least so I can learn a bit more about what's around ...

And about linux, I'm no expert at all on it ... so I don't think it would be a good solution if I can't properly maintain a system like that.

I want to earn the customer, so the solution I implement will be important.

Thanks.

 

[skyking]

I am one of those linux guys, but would not recommend that for you
Stick with a reliable hardware device for the routing.
Centralized virus and anti hack on a 4 client network? As ktwebb stated, that is really too pricey. The only possible economical solution involves more of that linux stuff, with much more than passing knowledge. Setting up a web proxy and mail proxy with spamassassin and clam antivirus is no trivial matter, and would take even the most expert user several hours to complete. It would therefore be a sort of false economy on the initial setup. I know I'd charge in excess of a grand to get that going, bulletproof, reliable.
It makes more sense to use a client-level antivirus spam blocking solution, and implement a scheduled program for maintenance.

 

[b4u]

Originally posted by: skyking
It makes more sense to use a client-level antivirus spam blocking solution, and implement a scheduled program for maintenance.

Can you point me to some software that could do that? Any software you know of.

Thanks

 

[skyking]

I'm sorry, I should have been more specific. I mean a program, something that humans do too
An example would be to have a designated person log into each machine as admin once a week and run updates, etc.

 

[Zuke]

I administrate the network for the school that our church runs (preschool - 8th grade). It's a win2000 network with about 45 client machines.
I have a cable modem attached to a linux box running IPcop www.ipcop.org which is then attached to one of our switches. IPcop is a firewall-only linux distro and pretty easy to setup. I highly recommend it.
If you can, I recommend running two servers - a primary domain controller and a backup domain controller. That way if you every have a problem with your primary domain controller, you can run from the backup with little or no loss in service. Trying to restore Active Directory from a backup is a major PITA. Much simpler to run a backup domain controller. Our PDC functions as file server and DHCP. BDC does DNS and SUS. I'm pretty happy with it - very low maintenance.

 

[stash]

I would also recommend running two DCs, if your budget allows for it. I just want to note that there are no PDCs and BDCs with 2000/2003 domain controllers. All domain controllers hold a read/write copy of the database.

 

[b4u]

I have only one server, and getting another one is not an option right now (and not for a 4 computer network). I'll definetly (sp?) have a look into linux ipcop, at least to learn a bit more about it ... it's a question of time until a learn a bit about linux, but for the next couple of months, I really have no time to spare learning linux, at least to put up a network depending on it at some point.

Thanks for the answers so far ... keep more ideas flowing this way