<![CDATA[
As IT professionals we know that server backups are our sole responsibility.  There is no one else in the building worrying about it (until they lose stuff) and no one is looking over your shoulder.  But when the crypto-virus hits, when a catastrophic power event kills your servers, when your boss deletes the same folder for the tenth time…can you get it back?
All the training in the world will not prevent every user from clicking on that download.  I do training, I tell users not to click on unexpected attachments, but it happens.  Are you ready?  FYI, not selling anything.
Backups are easy.  In fact, with Server 2016, they are easier than easy.  In each of my VMWare machines there exists and “extra” 6TB drive.  On this drive I added an extra drive to each virtual server and setup automatic daily backups.  In general, this has been a flawless technique.  I can restore files in minutes.  Users do not have access (so the crytovirus doesn’t touch them) and they can be archived.  I use a daily batch to copy these backups weeks to another backup server, giving me redundancy.  I also have a copy in the vault that I remake every once in while.
“The cloud is better!”  I have heard that alot, but I don’t think so.  If all our user documents are on Google we are a slave to the internet.  Yes, an IT guy just said that!  Our internet goes down every single year!  There has not been a single year since I became Technology Coordinator that it hasn’t happened!  Does teaching stop when the internet goes down?  It might, if everything a teacher uses is in the cloud.  Instead, we keep most things internal.  Our LMS (Moodle,)  file servers, web servers, you name it.  If the internet goes down, we lose the internet.  Most teachers can continue without it.  Maybe a lesson is altered for the day, maybe not.  But teaching still happens.  In districts where everything is in the cloud, it comes to a standstill.
Consider monthly or weekly archival moves to the cloud, not all.  With the low cost of 6-8TB drives these days I would far rather have all these files local, and save my bandwidth for what isn’t our content.]]>

<![CDATA[Is this a strange question?  Some would think so.  I have known  a local IT shop that had only one.  They lost it in a storm, had no backup, and paid $35K to have an IT company make a new one.  After that, they still only had one!  Later the local IT company was hired to augment the IT shop, and they immediately put in a BDC.  Theirs actually became the PDC (yes those term still exist in FSMO) and then it was later removed when their contract ended, leaving not PDC.  So, is it a bad question?  I think not.
Now the most basic answer, for a single location situation, is 2.  Just not 1!   If you have multiple locations I would have 1 at each location.  For a school district (or business) with multiple complexes, a Domain Controller at each complex location would be optimal.  Each DC should handle DHCP and DNS as well.  This allows for local logons to be optimal, with little or no delay.  Additionally I would recommend file servers per complex so that the user files are as local as possible.  A single VMWare (or Hyper-V) machine can handle these various servers (I still make separate role servers) easily.

Server 2016 lets you split DHCP ranges.  As I have different VLANs and ranges per building, I can give the building primary (the close one) most of the range.  I do this by making the VLAN on the machine at the location have no delay, and then put in a delay in that VLAN for the other DCs.  Even in a single location situation I would recommend a delay on the BDC.  This allow one machine to handle normal logons, and allows you a way to gauge your network.  I have a 1ms delay on the BDC and it gets about 5% of the logons.  This is excellent feedback that the network is running well, and is healthy.  If I had a 1ms delay and 40-60% of the logons were on the BDC, I could have an issue.
I have a 10G network with all workstations on 1G connections, including the wireless APs.  The APs are AC and can handle 200 clients, with an AP in every room.  I also have a single location situation with 1200 devices (plus student and staff BYOD connecting as well.)
Back to logon delay.  I would highly recommend playing with this to find your network sweet spot.  Find the __ms setting that results in a 10% or lower fallback to the DC that is secondary (or tertiary).  If every DC is primary on a different VLAN (the primary VLAN for the physical location) then you have fallback for heavy logon times while maintaining the fastest speeds.
With network bandwidth becoming more an issue every day, it is our responsibility as IT professionals to make the user experience and fast and flawless as possible.  We impact the business at hand, and possible loss of production, more than some realize.  Finding the sweet spot for network logons, file access, and internet access, is one the primary ways we can make the things we do in the background obvious to those we support.]]>

<![CDATA[
Let me start this post by ensuring you that I am on a limited budget trying to effectively manage a 1:1.  I am sure there are paid alternatives, and possibly better free ones, that accomplishes this in other ways.  But it works!
Students lose laptops, forget where they put them, have them stolen, leave them on the bus for a 3rd grader to find (kept it for 2 weeks before his parents found it) and so forth.  They usually come crying to us a few days (sometimes weeks) later and don’t have a clue where it is.  How can we find it?
I have taken a tracking approach to simply let the laptop tell me where its is, who is using it, and what wifi it is on.  I do this through a logon batch script that simply sends a email to a tracking email account on each logon.  Yep, that is a lot of emails, but it is going to an account I only logon to when I need to find one.  I use gmail filters to put them in nice little folders by class, staff…
I use SendEmail (written by Brandon Zehm http://caspian.dotconf.net/)  This is in a folder on the C drive of my student laptops, and I added a logon script to execute logon.bat each logon.  I could do it on power on, timed, whenever.  Obviously task scheduler is used to execute the task as system.  All the information on how to use his code is in a text file in his download.
To make my batch file work simply replace:

1. gmailsmtp@gmail.com with your gmail account it is coming from in SMTP
2. gmpassword with the password for the account above.  Assuming GMAIL SMTP
3. trackingemail@gmail.com with the email you want to be receiving these notices.
4. @yourdomain.com with your actual domain.  It will then be sending the email from the user email address (in the from field.)

I am using netsh wlan show interface > c:\users\%username%\profile.txt to dump information to attach.  You could do ipconfig /all > profile.txt in the section for non-wifi users to try and find where it is plugged in as well.  I found this to not be very useful, but you might.
The end result.  If a student leaves his laptop lying around.  Someone else could pick it up and take it home.  But it will be of no use since they have no logon account on that laptop.  They would have to logon to it, at school, to accomplish that.  Then they are the last logon to the laptop.  I have had a student drive in at midnight, sit in the parking lot, and logon.  Yes, that has happened.  The point is that to make it usable, they have to logon.  And  I instantly know who did it.  If I am tracking a particular laptop I can have a gmail forwarded to me the instant it is used.
I have also had a student clean one all up and sell it to another student (like I didn’t have the motherboard serial numbers) and think I wouldn’t notice.  Is this worth the time?  It certainly is to the student that doesn’t want to pay for the lost laptop!

ECHO OFF
REM Who is logging on?
set str=%username%
REM What class is the user (for GMail filtering into folders)
set str=%str:~0,2%
REM Dump the current WIFI SSID information into a file
netsh wlan show interface > c:\users\%username%\profile.txt
REM Student account start with the grad year (last 2) and if this is true…it is a student
If %str% LSS 100 goto studentlogons
REM If a non-student account is logging on, it is an “other” logon.
:otherlogons
C:\sendmail\sendEmail.exe -f %username%@yourdomain.com -t trackingemail@gmail.com -u %username% just logged to %computername% -m %computername% was logged on by User:%username% at %time% on %date% -a c:\users\%username%\profile.txt -s smtp.gmail.com:587 -xu gmailsmtp@gmail.com -xp gmpassword -o tls=yes
REM  It sent, goto end
If %errorlevel% == 0 goto end
REM If the laptop is not on WIFI, it errors, so send it without WIFI SSID Info
C:\sendmail\sendEmail.exe -f %username%@yourdomain.com -t trackingemail@gmail.com -u %username% just logged to %computername% -m %computername% was logged on by User:%username% at %time% on %date% -s smtp.gmail.com:587 -xu gmailsmtp@gmail.com -xp gmpassword -o tls=yes
goto end
:studentlogons
C:\sendmail\sendEmail.exe -f %username%@yourdomain.com -t trackingemail@gmail.com -u %username% just logged to %computername% Class:%str% -m %computername% was logged on by User:%username% at %time% on %date% -a c:\users\%username%\profile.txt -s smtp.gmail.com:587 -xu gmailsmtp@gmail.com -xp gmpassword -o tls=yes
REM  It sent, goto end
If %errorlevel% == 0 goto end
REM If the laptop is not on WIFI, it errors, so send it without WIFI SSID Info
C:\sendmail\sendEmail.exe -f %username%@yourdomain.com -t trackingemail@gmail.com -u %username% just logged to %computername% Class:%str% -m %computername% was logged on by User:%username% at %time% on %date% -s smtp.gmail.com:587 -xu gmailsmtp@gmail.com -xp gmpassword -o tls=yes
goto end
:end]]>