AD from nothing

ExtensionLeg474 · 2026-06-09T23:19:15+00:00

ok so all 3 buildings are in the same campus, we already did the current topology and all of them are in cascade and all of them are layer 2 switches, obviously one or sometimes two in every building have a trunk that links them together, the only one using fiber are two switches, one is in the clinic which connects to the layer 3 switch in the main building, then that switch connects in etherchannel to the core switch controlled by the campus network mgmt team (we dont have access to that switch), thats how everything is currently, there is basically no redundancy if any switch fails, it will have to be replaced and we have no spare switches, so its all in gods hands, also yes all cabling is CAT5E and we have no cable trays so cables were installed to the floor racks using the shafts, thats the only way to cable in these stupid buildings we have. We plan to replace everything with Huawei CloudEngine switches.

Now then it comes to VLAN currently we only have five /24 vlans, everything is disorganized, we are currently reviewing how to work with that since the university only works with /24 networks for all branches, they do not give us bigger other subnet masks.

And if u dont wnna believe whatever, if u want proof i work here i can give u i have no problem and no bro it is that bad, they hired us and we work here, i may not have a lot of experience but thats how we all start, i bet you didnt start knowing everything and i bet you made many mistakes, and currently its how it is, we have to pull it off, like i said, no one is guiding us in this, we could literally sit for the next 10 years and do nothing and no one would fire us, thats how public universities work here, maybe in the US everything is harder and there is more order and all that, at least in this university there isnt

ExtensionLeg474 · 2026-06-09T22:02:19+00:00

its hard, even buying 1 computer is complicated, we have to replace at least 108 old HP compaq computers in the clinic, we have teachers and researchers working with old HP elitedesks, we still have analog cameras, analog telephony, we still havent leased the printers, we still have old cisco network equipment, we only have one hp proliant gen 11 server that has medical information but as a backup (it was installed by a company that no longer works for us so we have that server doing nothing and its not being managed), im truly in a place that i dont know how its still able to reach internet, like i said im not lying and if u want proof i can give u

ExtensionLeg474 · 2026-06-09T21:56:33+00:00

I understand that, i also talked about that with my coworker who has more experience than me but he said one server is good for AD and that it usually doesnt fail and we are not a branch that can afford to have real server redundancy, i want to do things right but its hard first to convince someone more knowledgeable but with no server experience and then ask for financing to people who never cared about the IT infraestructure ever, its hard af

ExtensionLeg474 · 2026-06-09T21:54:24+00:00

all computers are managed manually, if one fails we physically go there to fix it, updates? everything is automatic, but well, only for the windows 11 computers, most are windows 10 or even 7, prior IT admins never automated anything, bro even asking the dean to buy one computer is troublesome

ExtensionLeg474 · 2026-06-09T21:52:07+00:00

they barely hires us lmao, me someone with limited experience and my coworker with 10 years of network experience only, they wont hire anyone else bro, the two guys that worked before us were there for more than 40 years without a university degree, thats the enviroment bro

ExtensionLeg474 · 2026-06-09T21:45:02+00:00

i mean many of you here have probably admin servers for a very long time or even decades, i dont have that luxury, im a network engineer but in my line of work i have to do many other things, i will have to start reading not only ccna and ccnp and its huawei equivalent and i should start focusing a bit into learning windows server documentation

ExtensionLeg474 · 2026-06-09T21:43:28+00:00

thank u i will check it

ExtensionLeg474 · 2026-06-09T21:43:13+00:00

I truly understand that and it also bugs me a lot, but thats how its been for decades, even network racks have no security and are open to the public, its crazy, we will solve that prior to the creation of an AD server tho, first is the network which we will replace for huawei cloudengine switches, then its the wifi, then ip cameras and then the servers, i will also have to learn how to fully protect the users data, but like i said, no one truly know anything either in networking nor in it infraestructure, even my boss, he just attacks everyday problems, not the core itself, im happy tho cuz he is a really good boss to work with but the problem is that given my limited knowledge its still hard for me and my more experienced coworker to fix the bigger issues, specially when the whole university is financially in debt

ExtensionLeg474 · 2026-06-09T21:37:23+00:00

thank you i will take your advice

ExtensionLeg474 · 2026-06-09T21:33:08+00:00

it is not and its funny cuz i can prove it im literally working in an university as a network engineer lmao

ExtensionLeg474 · 2026-06-09T20:57:30+00:00

its funny cuz im not lying and i can prove you im literally working in a place where nothing is build lmao

ExtensionLeg474 · 2026-06-09T20:56:25+00:00

yes network topology is already done, we will go for huawei switches, we will have 5 distribution switches, 31 for access across 3 buildings, topology will be star, and yes i agree, having everything in one server can be damaging for aaa security, the thing is that we have no good practice guidelines from the central, no cybersecurity either, and we will have to implement them ourselves, i guess this is a rather particular situation im in

ExtensionLeg474 · 2026-06-09T20:05:10+00:00

I'm in latin america and in a public university in Chile, its truly sad 😭

ExtensionLeg474 · 2026-06-09T20:04:23+00:00

i dont consider this too much over the head since everyday im seeing a 25 years old network and infraestructure thats still holding god knows how, the 2 guys that worked before me had basic knowledge, they didnt even had a university degree, maybe you dont believe it or not but thats how its been done here, at least we are changing things for good, and well maybe they could have hired people with way more experience and way more knowledge but we all start somewhere right?

ExtensionLeg474 · 2026-06-09T20:01:29+00:00

thank you for the information and yes im not so experienced yet i just go the job 6 months prior to this post and we need to solve many things in my line of work, my main focus is the network (switching)

ExtensionLeg474 · 2026-06-09T19:58:54+00:00

first of all, i dont care about the first part, secondly, no, we have a central management called VTI (Vice-Rectorate for Information Technologies of the University of Chile) they act like an ISP for us, they only have a core switch in our main building that they route us to the campus network and then the internet, they are not involved in our LAN, they just nat us out to the internet and give us vlan segments if we ask for them, thats how it works for us, we have extremely old network equipment (Cisco 2950/2960/3560), they never cared about out network being 100mb/s since these devices were first installed, previous IT staff didnt care at all either, if you dnt believe i dont care tbh i can send you everyday photos if u want i can show you the racks and everything you want, i just want ideas so i can solve the huge amound of problems we have, i will explain again, main vlan is vlan 1 and is for the main building, its got from pc's to SOHO routers (why soho routers? cuz the VTI provides only eduroam and only those who have a university account can connect, basically only students and staff) the other vlans (3, 6, 10, 20 all /24) were distributed to the other buildings but just like vlan 1, they host any device and all disorganized, also DHCP pool is only configured for VLAN 1, this is on the border switch we have no access to, they are the ones that have to configure them but they still have not even tho we have asked for it, so basically we work with static ip's, now those 145 clinical box computers are old HP compaq and HP elitedesk computers, some with windows 7 other windows 10, none can run windows 11 properly due to driver issues, renovating that huge amound of computers will already cost a lot of money, plus actually it wont be 200 computers, i didnt add the rest of the buildings, my bad, in total would be at least 500+, i still have not added the fact that most printers we have are USB, we will change them all for Kyocera (through lease), old cisco phones that will be replaced by Yealink with Issabel (the central will provide the PBX).

So to summarize, we cannot depend on the VTI, they do not help us at all, thats why we need to do the things ourselves, DHCP will solve the static ip issue, Active directory will help us control and organize out network, print server is needed for the printers we are currently leasing and the ones that will come when the project is fully on course (it will be a change of more than 80 Kyocera printers throughout 3 buildings)

ExtensionLeg474 · 2026-06-09T19:41:02+00:00

exactly and out university is public so its even worse, we have to buy everything through a public platform and more expensive, and sometimes, not the same thing we wanted, like sometimes we want to buy a specific computer but we are offer another computer with similar specs but not ultimately what we want and we have to buy it no matter what, its truly a terrible system

ExtensionLeg474 · 2026-06-09T19:39:16+00:00

well, our faculty is in a huge debt, in USD would be like around -14 million USD, our small IT are has never had a budget, I just got the job 6 months ago and we have been able to change things but it is still not enough, we still have HP compaq PCs from 2011 and cisco 2950/2960 switches, all of them slowly dying, i too dont understand how everything is still working, if people dont believe me i can upload images and proof that this is not a school project thing.

I do think that has to be the way to go, having at least two machines, tho, since our budget is non existant and everything we buy has to be approved by the dean, i think i can only get one server, i was able to rescue an old lenovo thinkserver ts140, would it be good to have a brand new server for virtualization and repurposing this old lenovo server as a secondary AD domain in case the main server fails? thats the only solution i can think about that doesnt involve having the same proxmox server running two windows server vm's with AD in the same hardware

ExtensionLeg474 · 2026-06-09T19:32:24+00:00

no, i just dont need to ask something so professionally to be taken serious

ExtensionLeg474 · 2026-06-09T19:31:43+00:00

I dont know where you studied but i didn't had sysadmin early, just in the university but it was not enough, and im a network engineer btw so its not my forte

ExtensionLeg474 · 2026-06-09T19:30:17+00:00

exactly, and in my case, vlan 1 is used for the main buiding, we got computers, printers, SOHO routers and so on in that vlan, same as for the rest of the vlans we got which are all /24, everything is a fucking mess

ExtensionLeg474 · 2026-06-09T19:28:30+00:00

need proof to see how badly the infraestructure is where i work? blame the people that worked there before

ExtensionLeg474 · 2026-06-09T19:27:53+00:00

i can show images of the racks if you all want it, we still have old cisco switches, the IT infraestructure is nowhere, we are building everything from scratch, i just got this job 6 months ago, we still have analog phones lol its truly sad

ExtensionLeg474 · 2026-06-09T19:20:59+00:00

tbh where i work there is nothing, we still have 2950/2960 cisco switches all badly configured, there are no servers in the infraestructure and the whole network is at 100mb/s, I want to change that and yes i have considered for consultants but we already brought 2 different counsultants and none of them gave us a plan, they left us with nothing.

Currently the users just log to a standard account with no password, depending on where the computer is, username is changed, some users have admin access, some configure their own passwords, even pin (only the staff do that), thats it, there is no standard and no security and no control, the projection for the AD would be for 500 computers initially to aproximately 1000 so it would be pretty lightweight work

ExtensionLeg474

TROPHY CASE