Terminal Services on DC bad idea ?

[mitzysman]

I'm setting up a 2003 Server. Will be running Terminal Services (Application Mode) to support about 40 users on a program that needs to run in terminal server.

is making it a DC a bad idea. I realize that I would need to give them log on local rights.

 

[IMdaTEK]

why does it need to be a Domain Controller?

 

[mitzysman]

it doesn't have to be. I'm just in the habit of putting a DC at each of our locations for fault tolerance and speed issues.

 

[IMdaTEK]

it shouldn't be a problem

 

[technome]

For TS to work the users need to log on have the locally right, which physically gives the access to the server. Then there are problem of applying GPO to a DC. Thirdly a TS needs to be locked down as far as program usage and file access, no less Internet access by users allows malware and virus threats. Unlike a member server, DCs will cause major problems if they are corrupted, much less is at stake with a member server. DCs if comprised by a hacker gives total access to a network, where as a member server does not. Lastly a DC has other services it must perform, and TS is very demanding. With 40 users I would not make it a TS.

 

[mitzysman]

thanks to all !!

 

[pgaliardo]

Technome is correct. Best practices rule is that you don't install TS on your DC. The reasons that technome states should be more than enough reason not to do it, especially with 40 users.