|
All fair points, Paul - I guess I'd view these concerns in
a different way:
- Use a GPO management tool to abstract away native
GPO rights
- If admins cannot be trusted not to fill SYSVOL with
sh** then don't give them any rights in SYSVOL [similar to above
point]
- If SYSVOL has its own partition, you still have the
potential for adminA to fill the disk with cr** and thus hinder the legitimate
efforts of adminB to make changes to a GPO. Granted, this 'DOS' only affects
SYSVOL, but then if GPO is broken then you're in big trouble anyway
:)
- Granted a separate disk for logs
*is* overkill. Consider using that partition / disk in other ways (GPO
backups; system state backups, build source files etc
etc).
my 2 penneth,
neil
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Paul Williams Sent: 08 August 2006 16:22 To: [email protected] Subject: Re: [ActiveDir] Moving Sysvol . I believe the school of thought here is
that the person has write access to the same volume as the DIT, which means he/
she can easily perform DOS attacks, etc. by filling up the disk.
I agree it's unlikely, but there you
go. Take the [real] examples of where people with write access to SYSVOL
have decided to replicate ghost images, etc. which not only trashes FRS, but
fills the disk so that only the 20MB reserve files are left (which can easily be
used up with dodgy custom synchronisation scripts that don't know what an USN is
[past experience showing?] ;-)
I don't believe the recommendations for
Logs and DIT go either. Yes, the logs are predominently write, while most
of the DIT usage is read, but the logs are circular. Why waste a mirrored
set for < 100 MB of disk even if disk is cheap? Plus, as already stated
in the same argument, most of the activity is read, so is there really
performance to be gained by having nano-second better response times on the file
writes? Other than implementation or re-provisioning or restoration, I
can't see the need to separate the logs.
I'm involved with a design at the moment
that has a 30+ GB DIT (~320,000 users at the moment) and I'm using my earlier
recommendations for the disks for DCs. We're arguing over whether RAID10
or RAID5 for the logical disk(s) that conatin the non-OS volumes should be used,
but there's not much difference there on a 4 - 6 disk set -the argument is
political to do with different standards for the management people. But
then, the SYSVOL volume is also a scratch area for administrators. The DIT
and OS volumes are very much off limits, and secured thus.
--Paul
PLEASE READ: The information contained in this email is confidential and
intended for the named recipient(s) only. If you are not an intended
recipient of this email please notify the sender immediately and delete your
copy from your system. You must not copy, distribute or take any further
action in reliance on it. Email is not a secure method of communication and
Nomura International plc ('NIplc') will not, to the extent permitted by law,
accept responsibility or liability for (a) the accuracy or completeness of,
or (b) the presence of any virus, worm or similar malicious or disabling
code in, this message or any attachment(s) to it. If verification of this
email is sought then please request a hard copy. Unless otherwise stated
this email: (1) is not, and should not be treated or relied upon as,
investment research; (2) contains views or opinions that are solely those of
the author and do not necessarily represent those of NIplc; (3) is intended
for informational purposes only and is not a recommendation, solicitation or
offer to buy or sell securities or related financial instruments. NIplc
does not provide investment services to private customers. Authorised and
regulated by the Financial Services Authority. Registered in England
no. 1550505 VAT No. 447 2492 35. Registered Office: 1 St Martin's-le-Grand,
London, EC1A 4NP. A member of the Nomura group of companies.
|
- RE: [ActiveDir] Moving Sysvol . neil.ruston
- Re: [ActiveDir] Moving Sysvol . Paul Williams
- RE: [ActiveDir] Moving Sysvol . Almeida Pinto, Jorge de
