Skip to main content
Super User

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

5
  • We typically make the DC also the fileserver, that way there is no issue.
    – LPChip
    Commented Feb 27, 2021 at 16:52
  • @ LPChip I'm tempted, but best practice is to not clutter/open holes in DC. Trying to keep it clean and segregated so hoping for another way.
    – geardogg
    Commented Feb 27, 2021 at 17:08
  • What exactly is the hole you open if you move files from one server to another, set shares and alter GPO to use the new location instead of the old? Unless of course you have a weird rights structure with specific rights 4 levels deep into the file structure. We keep permissions on the share and at best one level down to keep it manageable.
    – LPChip
    Commented Feb 27, 2021 at 21:37
  • @LPChip, I don't honestly know all the file sharing ports or vulnerabilities this might enable. I base my previous statement on what I've read. It always seems to be advised that you keep your DC a DC and nothing else. I take that thinking to be keeping the heart of your domain safe. I do appreciate your thinking, but I'm hoping to not have to make each of my host clone standbys in the DFS replication group a DC also.
    – geardogg
    Commented Feb 28, 2021 at 17:05
  • Well, yes, but a DC already has to act as a SMB file server for the Sysvol, so it's literally the same thing...
    – grawity_u1686
    Commented Mar 4, 2021 at 22:45