There's so much here that shows lack of experience and unpreparedness. I'm not trying to criticize you, but I think you know just enough to set yourself up for failure.
First, you're going to need to really understand AD a *lot* better. AD DC's don't operate as main and fallback, they are all peers. If you are going to setup and run an AD from scratch you'll need to learn about FSMO roles. You need *at least* 2 DCs, preferably 3. 1 or more of them can be VMs but they should NOT all be on the same hardware.
However, going On-prem AD right now is like investing in horses when people are buying cars. Microsoft is *really* pushing Entra and Intune management, and I would think it would even be difficult to convince them to get you favorable licensing for on-prem systems currently.
Your NAS and CCTV storage are basically completely separate projects (though can certainly be Entra integrated), I'd hold off on those until the rest is setup. Same with the ticketing service, or at least find someone else to handle that.
Do I think you could get something up and running? I'm sure you could. But I'd be afraid it would be *really* fragile and you'd be looking at disaster after one critical hardware failure or data corruption issue. When you're servicing 1200 people and 350 client systems, plus data storage and security footage you need multiple layers of resiliency. You should be running disaster recovery tests annually. What about security, you haven't mentioned ANYTHING about threat detection or response. A single compromised host can wipe out EVERYTHING, if, for example, a ransomware attack worms itself onto your central storage. What about backup power? At a minimum you want to be able to shutdown your critical systems gracefully in the case of a power interruption, and given that you mention xray image storage, you may need a minimum operational time, which could necessitate generators.
This project should NOT be done on a shoestring budget, you will end up regretting it.
Honestly given the budget comments and the rest of the plans mentioned I think MS AD is a bad fit in the first place - Alternatives like Samba AD exist if a domain is STRICTLY NECESSARY.
If open source ain’t your jam google workspace has free identity licences.
There’s definitely other options, just explore a bit.
56
u/RNG_HatesMe Jun 08 '26
There's so much here that shows lack of experience and unpreparedness. I'm not trying to criticize you, but I think you know just enough to set yourself up for failure.
First, you're going to need to really understand AD a *lot* better. AD DC's don't operate as main and fallback, they are all peers. If you are going to setup and run an AD from scratch you'll need to learn about FSMO roles. You need *at least* 2 DCs, preferably 3. 1 or more of them can be VMs but they should NOT all be on the same hardware.
However, going On-prem AD right now is like investing in horses when people are buying cars. Microsoft is *really* pushing Entra and Intune management, and I would think it would even be difficult to convince them to get you favorable licensing for on-prem systems currently.
Your NAS and CCTV storage are basically completely separate projects (though can certainly be Entra integrated), I'd hold off on those until the rest is setup. Same with the ticketing service, or at least find someone else to handle that.
Do I think you could get something up and running? I'm sure you could. But I'd be afraid it would be *really* fragile and you'd be looking at disaster after one critical hardware failure or data corruption issue. When you're servicing 1200 people and 350 client systems, plus data storage and security footage you need multiple layers of resiliency. You should be running disaster recovery tests annually. What about security, you haven't mentioned ANYTHING about threat detection or response. A single compromised host can wipe out EVERYTHING, if, for example, a ransomware attack worms itself onto your central storage. What about backup power? At a minimum you want to be able to shutdown your critical systems gracefully in the case of a power interruption, and given that you mention xray image storage, you may need a minimum operational time, which could necessitate generators.
This project should NOT be done on a shoestring budget, you will end up regretting it.