Skip to main content

Server Standards

How DTC builds and runs servers for clients. This page is the overview; the detail sits in the pages it links to. Operational procedures (upgrades, troubleshooting, health checks) live in the Servers book.

Platform

  • Hypervisor: Hyper-V. Production workloads run as VMs on a Hyper-V host; physical bare-metal servers are legacy and are migrated at refresh.
  • The host is infrastructure, not a workload. It sits on the INFRA VLAN, runs nothing but Hyper-V, and is never backed up as a whole by any product — guest VMs are backed up individually.
  • Host networking: SET (Switch Embedded Teaming), up to 4 NICs, Dynamic load balancing, VM + management traffic only; storage NICs are not teamed and use MPIO. See Server Networking Standards.
  • Checkpoints are not backups. Lingering checkpoints are removed (virtualization/hyper-v/remediation/hyper-v-delete-all-checkpoints.ps1); host and VM state is inventoried by virtualization/hyper-v/inventory/hyper-v-inventory.ps1.
  • Integration services must match the host. Older guests (Server 2016) on a Server 2025 host need their integration components checked before migration — see the known incompatibility.

Placement and addressing

  • Domain controllers, file/print servers and dental PMS SQL servers on CORP; BDR, NAS/SAN and management VMs on INFRA.
  • Servers use DHCP reservations; only DNS servers (DCs), DHCP servers and gateways are static.
  • Names follow the Device Naming Convention.

Active Directory

New domains are named ad.company.com; legacy industry names (dental.company.com) are not renamed. Endpoints never point at a DC for DNS — the firewall forwards the AD zone to it. The build and operating standard is AD-001: DTC Standard Architecture; DC-side DNS is in Internal DNS Zone Management. DFSR health and duplicate machine SIDs are inventoried by identity/active-directory/*.

Storage and hardware

  • Out-of-band management (iDRAC) is configured on every physical server, with a 32+ character unique password per Client Credential Administration Standard.
  • RAID / Storage Spaces state is inventoried (storage/inventory/storage-inventory.ps1, storage/storage-spaces/inventory/storage-spaces-inventory.ps1) so a degraded array alerts before it fails.
  • Replace-vs-upgrade decisions for aging hardware follow the Server Lifecycle — Quote Validation Audit SOP.

Backup

Every server is protected under its client's tier per Backup & Data Protection Standards. On BDR and Availability clients the backup server is a DTC-owned DTCBSURE-[site] appliance running Veeam Backup & Replication at the pinned fleet version (Veeam Version Standard), converged by backup/veeam/configuration/veeam-provision.ps1.

Security

Servers carry the same baseline as workstations — Blackpoint, Defender, BitLocker where supported, LAPS-managed dtcadmin — see Security Standards. No vendor tooling is installed on a production server without an isolated VM, senior-technician approval and client notice (D-038).

Back to top