Skip to content

HQ Equipment Baseline

Objective

Define the minimum equipment and system roles required for the first HQ deployment so the project has a clear day-zero target before additional services or sites are introduced.

This page separates:

  • the initial HQ operational baseline
  • the validation footprint used to prove that baseline before the first production deployment

Design rule

For day zero, only keep equipment that is required to:

  • route and segment the site
  • host core identity services
  • provide shared storage
  • protect the environment with backups
  • support user connectivity on wired and wireless networks

Do not introduce extra infrastructure roles until a later phase requires them.

When a Windows server role is fully supported on Server Core, prefer Server Core over Desktop Experience to reduce resource consumption and attack surface.

Administrative management for Windows servers should be performed from a dedicated management workstation rather than by treating each server as an interactive daily admin desktop.

If more than one administrator needs to work concurrently, provide one dedicated management workstation per concurrent administrator instead of sharing a single admin endpoint.

Validation footprint for the first deployment

The lab is not meant to validate a different environment from the company deployment.

The purpose of the lab is to prove that the first real HQ deployment will work with the same required roles, network design, and operating model.

Where the lab is smaller than production, it may reduce only the quantity of user endpoints or peripheral devices. It must not remove a required infrastructure role from the first deployment design.

This is the current validation footprint used to prove the first HQ deployment baseline:

Category Item Quantity Notes
Edge routing HQ-CHR01 1 Authoritative router, VLAN gateway, NAT, firewall
Virtualization Proxmox node 1 Current validated node: H1
Directory services HQ-DC01 1 AD DS, DNS, DHCP
File services HQ-FS01 1 SMB shares and backup staging
Server administration HQ-MGMT01 1 Dedicated management workstation for the first concurrent administrator
Validation clients HQ-CL01, HQ-CL02 2 Domain join, GPO, SMB, internet validation
Printer validation HQ-PRN01 1 Printer VLAN validation target
Backup target Backup volume on HQ-FS01 1 Current validated backup landing zone

This footprint is sufficient to validate the first HQ deployment model:

  • VLAN routing
  • DHCP relay
  • domain creation
  • workstation join
  • baseline GPO
  • SMB access
  • backup creation
  • remote server administration workflow

Initial HQ operational baseline

For the first real HQ site, the recommended minimum is:

Category Item Quantity Required now Purpose
Internet edge ISP handoff 1 Yes Upstream connectivity
Routing and firewall HQ-CHR01 or equivalent edge firewall 1 Yes Routing, NAT, segmentation, policy enforcement
Switching Managed VLAN-aware switch 1 Yes Trunking, access ports, VLAN separation
Wireless Business access point 1+ Yes if Wi-Fi is used Corporate and guest SSIDs
Virtualization Hypervisor host 1 Yes Run Windows infrastructure workloads
Directory services HQ-DC01 1 Yes Identity, DNS, DHCP for day zero
File services HQ-FS01 1 Yes Department shares and backup landing zone
Server administration HQ-MGMT01 management workstation 1 Yes Admin tools, PowerShell, RSAT, server management jump point
User endpoints Windows client devices 15 target Yes Staff productivity endpoints
Printers Network printer 1+ Optional by business need Shared printing validation and operations
Power protection UPS 1+ Strongly recommended Clean shutdown and short outage tolerance
Backup storage Dedicated backup capacity 1 Yes System state and file-level backup retention

Minimum logical roles for HQ day zero

The site should start with these logical roles only:

Role Hostname pattern Required now Notes
Edge router/firewall HQ-CHR01 Yes Already defined in P01
Domain controller HQ-DC01 Yes First forest, DNS, DHCP
File server HQ-FS01 Yes First file services node
Management workstation HQ-MGMT01 Yes Primary server administration endpoint
Additional management workstation HQ-MGMT02+ When needed One per additional concurrent administrator
Workstation template TPL-W11E Yes Standard user endpoint source image
Optional dedicated device template TPL-W11-IOT Only if needed Kiosk or appliance-style endpoint use cases
Preferred server template TPL-WS2025-CORE Preferred where supported Default choice for supported infrastructure roles
Desktop server template TPL-WS2025 Only when required Use only for roles that genuinely require Desktop Experience

Do not add these roles on day zero unless a requirement already exists:

  • SQL server
  • application server
  • jump host
  • secondary domain controller
  • separate DHCP server
  • separate backup server
VLAN Purpose Typical equipment
20 Servers HQ-DC01, HQ-FS01, future member servers
30 Workstations User laptops, desktops, and HQ-MGMT01/HQ-MGMT02 unless a dedicated admin VLAN is later introduced
40 Printers Network printers
70 Guest Guest wireless clients only
90 Backup Backup-only targets or isolated backup flows
100 Hypervisors Proxmox management and similar infrastructure
110 Build Temporary image-build workloads only
120 Containers Router-hosted containers such as cloudflared

Day-zero purchasing view

If the goal is to stand up the first HQ quickly and correctly, the equipment list should be treated like this:

Must exist before domain deployment

  • ISP handoff
  • edge firewall/router
  • managed switch
  • hypervisor host
  • Windows Server template source

Must exist before workstation rollout

  • HQ-DC01
  • HQ-FS01
  • HQ-MGMT01
  • validated TPL-W11E
  • at least one wired or wireless path for VLAN 30
  • UPS coverage for network edge and hypervisor
  • documented backup target with confirmed retention
  • at least one business-grade access point if users rely on Wi-Fi

Growth triggers

Add more equipment only when a trigger exists:

Trigger Add
More than one administrator needs concurrent privileged access HQ-MGMT02, then one additional management workstation per concurrent administrator
Backup window or storage pressure on HQ-FS01 Dedicated backup server or repository
Identity availability becomes critical HQ-DC02
File workload grows beyond the first share server Additional file server or storage redesign
Wi-Fi coverage or density is insufficient More access points
Single-switch maintenance risk becomes unacceptable Redundant switching
Hypervisor outage becomes unacceptable Additional host and HA-capable design

Lab-to-deployment rule

For this project:

  • the lab must validate the exact infrastructure pattern intended for the first company deployment
  • the lab may reduce endpoint count for practicality
  • the lab must not omit required day-zero infrastructure roles and still claim the first deployment is validated

Examples:

  • validating 2 workstations in the lab for a 15-user first deployment is acceptable
  • one of those validated workstations should be the server administration workstation pattern if server administration is part of day-zero operations
  • if the first deployment expects two admins to work at the same time, the lab should validate HQ-MGMT01 and HQ-MGMT02, not only a single shared admin workstation
  • omitting the file server from the lab while planning to deploy one on day zero is not acceptable
  • omitting backup validation from the lab while planning backups for day zero is not acceptable

Approved HQ day-zero baseline

For this project, the approved initial HQ baseline is:

  • 1 edge firewall/router
  • 1 managed VLAN-aware switch
  • 1 hypervisor host
  • 1 domain controller
  • 1 file server
  • 1 management workstation for server administration
  • 1 backup target
  • 15 standard user endpoints as planning target
  • 1+ access points if wireless is required
  • 1+ printers only when business need exists
  • 1+ UPS units protecting the edge and compute stack

This is the baseline that should drive the next infrastructure and runbook decisions.

If 2 or more administrators must operate in parallel, expand the baseline to one dedicated management workstation per concurrent administrator.