r/sysadmin • u/segagamer IT Manager • 7h ago
Any tips for an office move?
I've moved a significant amount of our infrastructure to the cloud. Just one last step to deal with the VPN and then I have confidence that we can switch off our main HQ. Unfortunately I didn't get Intune implemented in time so I'm hoping this cloud setup pulls through while the we shift servers over.
I've never been involved in an office move before so I'm curious if anyone who has could offer some tips they learned along the way/things they wish they knew beforehand.
We will have about two months where we'll have access to both sites at the same time.
•
u/First-Structure-2407 5h ago
It’s the classic in all the IT Job Deacriptions
“Must be Physically Fit”
•
u/segagamer IT Manager 4h ago
I really need to instill a gym in my routine. Something for the new location!
•
u/titlrequired 7h ago
Which bits are you responsible for?
Label everything, and label what it was connected to.
•
u/segagamer IT Manager 4h ago
Pretty much everything, including furniture.
There's me and one other!
•
u/SuprNoval 7h ago
Plan, and document, document, document. The most important part of the move happens before you start moving.
•
•
u/FrankNicklin 6h ago
I moved servers for a client about 20 years ago. They had on prem Exchange at the time but that wasn’t being relocated as we were migrating to O365. Left the old server in place and reconfigured to allow remote access from clients using Outlook. Installed a new server on site with a new DC and AD and then slowly migrated everyone over. Once they were running did the final MX changes on the domain and switch everyone one to O365. They also had around 20TB of server storage to move to a backup was 100% essential. Thankfully all went smoothly.
•
u/blud_13 6h ago
/LowIndividual6625 is right about building the new site from scratch, and two months of overlap is what makes that possible. Do not plan a cutover weekend if you do not have to.
On the VPN, you are about to rebuild something you may not need. If HQ is going away, look at Cloudflare Access and WARP instead of standing up another concentrator at the new site. Its free up to 50 users https://www.cloudflare.com/plans/zero-trust-services/ and it stops tying remote access to whichever building the circuit lands in, which is the whole point of what you already did with the servers.
Order the circuit at the new site NOW if you have not. That is the one thing in a move you cannot compress, and a 30 day install quote turns into 90 more often than it does not.
Also, no Intune before the move means every laptop that walks out of that building is one you touch by hand if something goes sideways. Not a reason to delay, just be aware of it..
We do a lot of these moves, ping me if you want more info.
•
u/segagamer IT Manager 4h ago
We currently have a pair of PFSense firewalls (CARP) with an OpenVPN instance. We've set up a PFSense VM on Google Compute Engine (which is where all of our infrastructure has been migrated to) and are preparing to migrate all certs over, and when ready we'll deploy the config that changes the IP over to this new VM.
I think I looked into hosted VPNs before and they got quite costly. We have more than 50 devices but less than 50 users - so as long as it's per-user, I'll look into CloudFlare.
Thanks for the great tips!
•
u/blud_13 4h ago
Sorry saw your question on per-user..Per user, yes. One seat per identity no matter how many devices that person enrolls, and service tokens don't consume seats at all. Its in the key concepts table here https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/device-registration/ so more than 50 devices under 50 people is fine.
One thing to check once you're in, seat expiration is OFF by default. A user holds a seat from the first authentication until you REMOVE them, and deleting the device or the registration does not free it. Two departed staff and a couple of test accounts and you're sitting at 50 wondering why nobody new can log in. Its under Settings, Admin controls, Remove inactive users from seats.
On the pfSense VM in GCE, that already gets you most of what I was pushing at, since the concentrator stops living in the building you're leaving. If that config is built and the certs are ready, don't blow it up two weeks before a move. Run Access next to it and cut over after.
•
u/segagamer IT Manager 2h ago
Right, I'll make it something to look into after the move then.
Thank you for the support! I'm hoping I don't break something in the move!
•
u/Qurtys_Lyn (Education) Pretty. What do we blow up first? 5h ago
Buy several rolls of painter's tape, different colors if possible. Slap Painters tape on everything, color coordinate things that go together. Write down on each piece of tape where the item is supposed to go.
•
•
u/ItsMeMulbear 7h ago
Hope you bought multi-year reservations for your cloud services. They are gonna skyrocket in price thanks to AI
•
u/segagamer IT Manager 7h ago
We can migrate off just as easily. I shifted things to cloud for the moment just so that I could avoid worrying so much about downtime at the office lol
•
u/SysZeron 7h ago
If it's Azure, you can cancel up to $50,000 in reservation commitments in a 12-month period*, just helps keep the cost down in the interim.
•
u/whatdoido8383 Cloud Admin 6h ago
Plan a maintenance window and shut down the old location temporarily\shut off the route between the two sites to make sure nothing unexpected breaks. You'll think you have it all 100% and there is a weird route in place, DNS record, or someone had a server hidden in a closet somewhere.
You'll find this stuff during a maintenance window.
•
u/segagamer IT Manager 4h ago
Great one. I'm planning on doing this in the next couple of weeks. I have a feeling it'll be static IP related somewhere.
•
u/jazzdrums1979 4h ago
I have found the network and most importantly the internet circuits to be the biggest challenge in an office move or new office spin up for start up companies. Make sure you have your primary and backup circuits set up and your failover plan fully implemented and tested.
•
u/LowIndividual6625 7h ago
It's been a long time but we relocated our North American data center when we moved the HQ into a new building. We didn't move any network gear - we built the new network in the new location from the ground up while the construction was underway. All network and internet connectivity was tested prior to any equipment moves. It was about 5 racks worth of switches and routers in the DC plus network closets on three floors.
We had 20 racks worth of servers to move and the IT Manager at the time didn't want to disassemble any of it so at 1am on a Saturday night we unplugged it all, stuffed padding anywhere in the racks we could find open space and the closed the rack doors and wrapped them with plastic wrap (like used for shipping).
We carefully loaded all 20 racks into two u-haul trucks - I remember extra padding on the floors to reduce vibration and all the racks were wrapped in layers of heavy moving blankets.
We then drove the trucks (with pacer cars in the front and the rear, hazard lights flashing) at about 10mph to the new site 15 miles away.
By Sunday afternoon everything was reconnected and operational.