Running applications on Domain Controller: Risk?

[nitrobass24]

Is there any reasons why a company should not run a financial application on a domain controller, besides performance/uptime?

The external auditors are flipping a shit because my client is running ADP(payroll) on a domain controller. I just dont see what the big deal is.

 

[corge]

We have two domain controllers at each geographic location. They do DC only, period, nothing else, ever.

Any more roles that you add to the Domain Controllers are basically putting the machine at risk for something to happen or to be compromised.

 

[DeChache]

For the most part you shouldn't run anything that isn't necessary on a infrastructure server. If for no other reason that people can at least try to work if an update brings down the app server but if the infrastructure is down they are dead in the water.

 

[goodcooper]

For the most part you shouldn't run anything that isn't necessary on a infrastructure server. If for no other reason that people can at least try to work if an update brings down the app server but if the infrastructure is down they are dead in the water.

that's my mentality... but i don't have a problem with running VMs on an infrastructure machine.... if it can handle it... i put my apps in those...

 

[Eiolon]

Besides the issues presented above, I prefer not to put all my eggs in one basket. If it can be afforded, I like to dedicate servers to specific apps.

 

[nitrobass24]

Any more roles that you add to the Domain Controllers are basically putting the machine at risk for something to happen or to be compromised.

Ok what are these risks?

Sorry for being dense but im just trying to obtain a full understanding.

Things that i have seen.

1. Application update takes this DC offline.
2. Application runs poorly

 

[YeOldeStonecat]

The less you do on a DC, the better.
Also, depends on the size of your company, as....if your DC has to run a "large network"...and it gets screwed trying to allocate much of its processing power to some bloated accounting app like QuickBloatPro...all the clients of the network suffer..slow logins, slow DNS replies, way behind print jobs, etc.

Sometimes you'll install software that borks up your computer. Imagine installing something on a domain controller...that tanked it? Oh boy...company is screwed for at least a few hours now...

I remember a couple of years ago.....this architect firm I helped do some work on. They had a DC...their domain controller.
It also was a terminal server...for remote users.
It also had Timberline installed on it...
And..it also was used locally..by some lady in the office...who sat down in front of it and used it as a regular workstation..yes....checking e-mail...surfing the web...oh yeah.

Now...they always had problems with it. Go figure..... Had to frequently be rebooted for various reasons.

 

[goodcooper]

Ok what are these risks?

Sorry for being dense but im just trying to obtain a full understanding.

Things that i have seen.

1. Application update takes this DC offline.
2. Application runs poorly

extremely poorly written software can sometimes require OS reloads... which when talking about DCs is generally a bad thing...

 

[danman]

Ok what are these risks?

Sorry for being dense but im just trying to obtain a full understanding.

Things that i have seen.

1. Application update takes this DC offline.
2. Application runs poorly

Security. One exploit and you open up the DC to compromise. You want the lowest attack surface possible on a DC.

 

[DeChache]

The less you do on a DC, the better.
Also, depends on the size of your company, as....if your DC has to run a "large network"...and it gets screwed trying to allocate much of its processing power to some bloated accounting app like QuickBloatPro...all the clients of the network suffer..slow logins, slow DNS replies, way behind print jobs, etc.

Sometimes you'll install software that borks up your computer. Imagine installing something on a domain controller...that tanked it? Oh boy...company is screwed for at least a few hours now...

I remember a couple of years ago.....this architect firm I helped do some work on. They had a DC...their domain controller.
It also was a terminal server...for remote users.
It also had Timberline installed on it...
And..it also was used locally..by some lady in the office...who sat down in front of it and used it as a regular workstation..yes....checking e-mail...surfing the web...oh yeah.

Now...they always had problems with it. Go figure..... Had to frequently be rebooted for various reasons.

OMG

Its like my worst nightmare.

I have a client using their "server" as a workstation but its just running the master quickbooks install.

 

[RiDDLeRThC]

on each of our domain controllers we run AD and DNS. on one of them its also running DHCP.