Why is Central Admin on an application server by default? It seems like if you wanted your app server to truly be an app server, then you wouldn't have it serving any sites. This seems like it could also be a problem for availability. If your app server goes down, then so does Central Admin. Of course this is assuming that there is only 1 app server, but most set ups I've seen, or read questions on, have 1 app server and 2 WFE's. Why not have Central admin on the WFE's?
1 Answer
I'm not sure on Microsoft's reasoning, but when I design farms, I purposely leave CA on an app server as it is not a high traffic site and won't affect performance of the app server.
It's the management tool for your farm, so keeping it on servers that its managing makes sense to me. It also allows you to extract a level of security by not putting it on a web front end, which could be accessed via a load balancer, instead it's on server that's behind the scenes that less users would even know about.
Just my 2 cents.
answered May 8, 2013 at 16:42
-
I agree with David on this. The CA aspect itself is strictly just an administrative interface, but the server it is installed on tends to be pretty important since it is the seed for your farm. Because of that, I also make it an app server. While SharePoint has evolved significantly over the past 12 years, and the deployments have gotten significantly more complex, this initial seed for the farm remains pretty important. Commented May 8, 2013 at 16:50
-
2David is correct. CA is an admin only site that has the potential to completely destroy your entire farm if misused or hacked. In many farms, particularly Internet/Extranet farms, the WFEs are exposed to the internet and are thus subject to being hacked. If Central Admin isn't even installed on a WFE, it eliminates the potential that a hacker will gain access to it. Commented May 8, 2013 at 16:54
-
I am surprised and appreciative of the quick feedback! It makes sense that you don't want to expose CA to the web. I hadn't considered that. The case I am facing is for a company's intranet. When it comes to the intranet, this doesn't seem to provide extra security. The only difference in accessing CA from any computer on the intranet is myspwfe:8080 vs myspapp:8080. I can, however, understand how the app server would be the default. Also, you mention that keeping it on the severs its managing makes sense.... but it also manages the WFE's and then you state you don't place it on those? Commented May 8, 2013 at 19:43
-
in a normal intranet deployment, the WFE is addressed as something like "Intranet.domain.com" whereas the app server usually is addressed as ServerName:port. Your point is technically correct in that it can be accessed just as easily, though it is usually far less likely to be done as nobody other than the SharePoint Admins even know the name of the app server. Commented May 8, 2013 at 20:05