SCCM hierarchy design

%3CLINGO-SUB%20id%3D%22lingo-sub-833318%22%20slang%3D%22en-US%22%3ESCCM%20hierarchy%20design%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-833318%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20All%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSPAN%3EI'm%20new%20to%20this%20community%20and%20SCCM%20so%20I%20would%20like%20some%20advice%20please%3B%20I%20currently%20have%20an%20SCCM%20CB%20environment%20running%20in%20the%20corporate%20domain%20and%20my%20company%20is%20planning%20on%20buying%20a%20few%20companies%20and%20they%20want%20to%20keep%20the%20domains%20separate%20but%20will%20have%20trusts%20in%20place.%26nbsp%3B%3C%2FSPAN%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSPAN%3EThe%20current%20environment%20is%20set%20up%20as%20follows%26nbsp%3B%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3EDomain%20A%20(Based%20in%20Europe)%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3E150%20users%26nbsp%3B%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3E1%20site%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3ECurrently%20has%20the%20only%20stand-alone%20primary%20site%26nbsp%3B%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3EBandwidth%20not%20an%20issue%3C%2FSPAN%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSPAN%3EDomain%20B%20(Based%20in%20Africa)%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3E350%20users%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3E3%20sites%26nbsp%3B%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3ENo%20SCCM%20service%26nbsp%3B%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3EBandwidth%20is%20very%20limited%20(reminds%20me%20of%20the%20old%20PSTN%20dial-up%20days)%3C%2FSPAN%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSPAN%3EDomain%20C%20(Based%20in%20South%20America)%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3E300%20users%26nbsp%3B%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3E5%20sites%26nbsp%3B%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3ENot%20bandwidth%20issues%3C%2FSPAN%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSPAN%3ESo%20what%20I%E2%80%99m%20looking%20for%20is%20some%20advice%20on%20how%20I%20should%20implement%20my%20SCCM%20infrastructure%3F%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3EWhat%20I%20was%20thinking%20was%20extending%20my%20current%20primary%20site%20with%20a%20CAS%20server%20and%20then%20installing%20a%20primary%20site%20server%20in%20each%20domain%20and%20extend%20those%20sites%20with%20secondary%20sites%20and%20DP%E2%80%99s%3F%26nbsp%3B%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3EIf%20I%20go%20this%20route%20will%20it%20give%20each%20local%20IT%20team%20the%20ability%20to%20manage%20there%20own%20SCCM%20server%20while%20having%20the%20corporate%20CAS%20server%20pushing%20down%20applications%20and%20policies%3F%20As%20each%20SCCM%20server%20will%20be%20installed%20into%20its%20own%20domain%2Fforest%20will%20I%20have%20any%20issues%20or%20challenges%3F%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-833318%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECM%20current%20branch%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Esccm%201906%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-836795%22%20slang%3D%22en-US%22%3ERe%3A%20SCCM%20hierarchy%20design%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-836795%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F342219%22%20target%3D%22_blank%22%3E%40TazzKT%3C%2FA%3E%26nbsp%3Bare%20you%20looking%20to%20consolidate%20your%20three%20environments%20into%20one%3F%3C%2FP%3E%3CP%3Eare%20there%20any%20links%20between%20each%20of%20the%20domains%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESounds%20like%20you%20do%20not%20need%20a%20CAS%2C%20instead%20just%20a%20Primary%20with%20a%20couple%20of%20secondaries%20hanging%20of%20it%20with%20DP%2C%20although%20it%20depends%20on%20how%20you%20answer%20the%20above.%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-838478%22%20slang%3D%22en-US%22%3ERe%3A%20SCCM%20hierarchy%20design%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-838478%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F342219%22%20target%3D%22_blank%22%3E%40TazzKT%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ehi%2C%26nbsp%3B%3C%2FP%3E%3CP%3Ei%20would%20agree%20with%26nbsp%3Bmcgees%2C%26nbsp%3B%3CBR%20%2F%3Ethere%20is%20no%20needs%20for%20the%20CAS-Primary%20Design%20on%20your%20side.%3C%2FP%3E%3CP%3Ethe%20Primary%20is%20fine.%20and%20personaly%20i%20would%20not%20install%20the%20secondary%20Site%2C%20if%20your%20network%20design%20ok%20and%20running%20without%20problems%20you%20should%20only%20place%20a%20couple%20of%20DP%20for%20the%20Deployments%20on%20the%20local%20sites.%20(this%20will%20reducue%20of%20cousere%20the%20bandwith%20for%20heavy%20installations%20like%26nbsp%3B%20OS%20Deployment%2C%20Windows%20Updates%20and%20so..%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-838545%22%20slang%3D%22en-US%22%3ERe%3A%20SCCM%20hierarchy%20design%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-838545%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F295623%22%20target%3D%22_blank%22%3E%40mcgees%3C%2FA%3E%26nbsp%3BThank%20you%20for%20taking%20the%20time%20to%20respond.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMy%20company%20has%20decided%20all%20three%20domains%20will%20remain%20but%20I%20will%20be%20creating%20a%202-way%20trust%20between%20the%20domains.%20I'm%20in%20the%20process%20of%20setting%20the%20companies%20up%20so%20that%20the%20network%20will%20be%20connected.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAs%20each%20site%20has%20there%20own%20IT%20team%20looking%20after%20each%20SCCM%20server%2C%20am%20I%20correct%20in%20saying%20that%20each%20secondary%20server%20can%20be%20in%20the%20separate%20domains%20and%20the%20team%20admins%20can%20connect%20to%20the%20secondary%20sites%20to%20administer%20and%20deploy%20site-specific%20applications%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-838561%22%20slang%3D%22en-US%22%3ERe%3A%20SCCM%20hierarchy%20design%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-838561%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F295354%22%20target%3D%22_blank%22%3E%40Klaus_Bilger%3C%2FA%3E%26nbsp%3B%20Thanks%20for%20taking%20the%20time%20to%20respond.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20issue%20I%20have%20is%20the%20Africa%20site's%20network%20is%20really%20slow%20and%20stability%20isn't%20the%20best%20so%20I%20was%20thinking%20a%20secondary%20site%20which%20is%20joined%20to%20the%20sites%20specific%20domain%20will%20be%20installed%20in%20the%20main%20office%20and%20then%20DP's%20to%20the%20smaller%20in-country%20offices%20as%20I've%20read%20a%20secondary%20site%20will%20help%20with%20limited%20bandwidth%20deployments%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-844646%22%20slang%3D%22en-US%22%3ERe%3A%20SCCM%20hierarchy%20design%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-844646%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F342219%22%20target%3D%22_blank%22%3E%40TazzKT%3C%2FA%3E%26nbsp%3BConfigMgr%20doesn't%20care%20about%20trusts%20between%20domains%20so%20that's%20irrelevant%20for%20this%20discussion%20really.%20Trusts%20are%20about%20authentication%2C%20ConfigMgr%20doesn't%20use%20AD%20to%20authenticate%20managed%20systems.%20The%20trust%20only%20matters%20if%20you%20will%20be%20targeting%20users%20with%20deployments%20as%20that's%20the%20only%20time%20AD%20authentication%20across%20forest%20boundaries%20matters.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CBLOCKQUOTE%3E%3CHR%20%2F%3E%0A%3CP%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%3EAs%20each%20site%20has%20there%20own%20IT%20team%20looking%20after%20each%20SCCM%20server%2C%20am%20I%20correct%20in%20saying%20that%20each%20secondary%20server%20can%20be%20in%20the%20separate%20domains%20and%20the%20team%20admins%20can%20connect%20to%20the%20secondary%20sites%20to%20administer%20and%20deploy%20site-specific%20applications%3F%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CHR%20%2F%3E%3C%2FBLOCKQUOTE%3E%0A%3CP%3ENo%2C%20this%20is%20not%20the%20purpose%20or%20function%20of%20secondary%20sites.%20Secondary%20sites%20are%20about%20extending%20a%20ConfigMgr%20primary%20site%20to%20remote%20locations%20with%20limited%20bandwidth%20connections.%20Administrative%20separation%20is%20provided%20using%20Role-based%20Administration%20in%20ConfigMgr%20and%20not%20an%20artifact%20of%20the%20infrastructure%20design.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-844654%22%20slang%3D%22en-US%22%3ERe%3A%20SCCM%20hierarchy%20design%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-844654%22%20slang%3D%22en-US%22%3E%3CP%3ESecondary%20sites%20have%20issues%20across%20high-latency%2C%20very%20low%20bandwidth%20links.%20Your%20best%20bet%20for%20the%20Africa%20locations%20is%20to%20use%20a%20PullDP%20(with%20BranchCache%20enabled%20to%20enable%20data%20deduplication)%20or%20just%20client-based%20BranchCache%20and%20enable%20LEDBAT%20on%20the%20site%20server%20and%20the%20DP%20that%20systems%20at%20that%20location%20pull%20content%20from.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
TazzKT
New Contributor

Hi All

I'm new to this community and SCCM so I would like some advice please; I currently have an SCCM CB environment running in the corporate domain and my company is planning on buying a few companies and they want to keep the domains separate but will have trusts in place. 

The current environment is set up as follows 
Domain A (Based in Europe)
150 users 
1 site
Currently has the only stand-alone primary site 
Bandwidth not an issue

Domain B (Based in Africa)
350 users
3 sites 
No SCCM service 
Bandwidth is very limited (reminds me of the old PSTN dial-up days)

Domain C (Based in South America)
300 users 
5 sites 
Not bandwidth issues

So what I’m looking for is some advice on how I should implement my SCCM infrastructure?
What I was thinking was extending my current primary site with a CAS server and then installing a primary site server in each domain and extend those sites with secondary sites and DP’s? 
If I go this route will it give each local IT team the ability to manage there own SCCM server while having the corporate CAS server pushing down applications and policies? As each SCCM server will be installed into its own domain/forest will I have any issues or challenges?

6 Replies

@TazzKT are you looking to consolidate your three environments into one?

are there any links between each of the domains?

 

Sounds like you do not need a CAS, instead just a Primary with a couple of secondaries hanging of it with DP, although it depends on how you answer the above. :)

@TazzKT 

 

hi, 

i would agree with mcgees, 
there is no needs for the CAS-Primary Design on your side.

the Primary is fine. and personaly i would not install the secondary Site, if your network design ok and running without problems you should only place a couple of DP for the Deployments on the local sites. (this will reducue of cousere the bandwith for heavy installations like  OS Deployment, Windows Updates and so.. 

 

@mcgees Thank you for taking the time to respond. 

 

My company has decided all three domains will remain but I will be creating a 2-way trust between the domains. I'm in the process of setting the companies up so that the network will be connected. 

 

As each site has there own IT team looking after each SCCM server, am I correct in saying that each secondary server can be in the separate domains and the team admins can connect to the secondary sites to administer and deploy site-specific applications? 

@Klaus_Bilger  Thanks for taking the time to respond. 

 

The issue I have is the Africa site's network is really slow and stability isn't the best so I was thinking a secondary site which is joined to the sites specific domain will be installed in the main office and then DP's to the smaller in-country offices as I've read a secondary site will help with limited bandwidth deployments? 

@TazzKT ConfigMgr doesn't care about trusts between domains so that's irrelevant for this discussion really. Trusts are about authentication, ConfigMgr doesn't use AD to authenticate managed systems. The trust only matters if you will be targeting users with deployments as that's the only time AD authentication across forest boundaries matters.

 


As each site has there own IT team looking after each SCCM server, am I correct in saying that each secondary server can be in the separate domains and the team admins can connect to the secondary sites to administer and deploy site-specific applications? 


No, this is not the purpose or function of secondary sites. Secondary sites are about extending a ConfigMgr primary site to remote locations with limited bandwidth connections. Administrative separation is provided using Role-based Administration in ConfigMgr and not an artifact of the infrastructure design.

Secondary sites have issues across high-latency, very low bandwidth links. Your best bet for the Africa locations is to use a PullDP (with BranchCache enabled to enable data deduplication) or just client-based BranchCache and enable LEDBAT on the site server and the DP that systems at that location pull content from.

Related Conversations
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
flashing a white screen while open new tab
cntvertex in Discussions on
13 Replies
Tabs and Dark Mode
cjc2112 in Discussions on
22 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
28 Replies
Edge insider Dev bypasses IE mode website list
HotCakeX in Enterprise on
4 Replies