Microsoft recommended use of
.local domain when Microsoft released Microsoft Small Business Server.
Microsoft also understood that an SBS customer may not have in house
expertise to manage Active Directory Domain and Exchange Server.
Microsoft understood that SBS user will not have proper firewall. It is
obvious that Exchange autodiscovery, single sign on for SharePoint and
Lync Server was not in scenario at that time. So Microsoft recommended
use of .local domain in Active Directory. Those who worked in SBS
environment thought that they could take that concept now and implement
.local domain in any organization which is a fundamental design flaw.
You have to understand that
.local domain was a past concept. Moving forward technology has changed a
lot since then. You should change yourself when technology changes. But
when I visit clients I see that old dog doesn’t learn new trick. Which
means their autodiscovery doesn’t work. These clients end up with many
issues including blaming Microsoft. You should ask yourself did you
design your Active Directory and DNS correctly. Why you expect your
autodiscovery to function correctly when your DNS is messy?
When you are promoting a new domain or a new forest, it is highly recommended that you use registered domain name for example yourdomain.com.au.
Again those who worked in past SBS era they will raise concern of
hacking, TLD etc. I would address their concern by putting the question
to them, did you design and configure a correct firewall and security in
your corporate infrastructure. If not then you should hire a security
professional who will address your concern. Simply promoting a yourdomain.local
domain will not secure your domain and you will have a false sense of
security that your Active Directory is safe. In realty your corporate
network might be open and vulnerable to hacking.
Here are why you should use yourdomain.com.au or registered domain in Active Directory.
- To implement correct Exchange Autodiscovery
- To discover correct registered domain for SharePoint and Lync Server
- To implement single sign on
- To install correct public certificates for Exchange, SharePoint and Lync. Note that Public Certificate Authority no longer issue certificate using .local domain
- To use correct UPN of your registered domain
- To setup correct local and public DNS
- To design correct Active Directory. You shouldn’t use SBS server as your model. Microsoft retired SBS for many reasons. Brutal truth is Microsoft didn’t want to lose poor customer who couldn’t afford an open license or software assurance so most of SBS users got OEM license through hardware vendor or a reseller.
- To follow the guidelines of IANA and IEEE when you deal with a domain.
If your SBS server is 2008, then create an Active Directory DNS zone using registered domain example: yourdomain.com.au then add HOST (A) record with PTR of webmail or mail and autodiscovery in yourdomain.com.au zone. Create public DNS record for webmail.yourdomain.com.au and autodiscover.yourdomain.com.au.
Published By
S.G.Godwin Dinesh.MCA
Sr.System Administrator
No comments:
Post a Comment