How to “kill” a computer network services on the lan

Reaching back to my days managing school labs here are some of my suggestions:

1. We would just get whatever mid level machine was available at the time, and as Oskar Duveborn has said get computer desks with lockable cages. We used the kind that would just clamp the top and bottom down, then we would use the built in lock to lock down the case and run a simple flexible chain through a fixure we superglued to the chassis and around the desk. Really what these are are deterents but even in the tech school where the kids had access to bolt cutter, welding tools, etc. I think we only had 2 or 3 breakins to the cases in the 3 years I was there. Basically just buy something reasonable and a few spares and expect the machines to be broken into no matter what you do - but don't let that be a reason to not put any deterrents in (for example we found a PB&J sandwiching in a CDROM Drive ones...)

2. We used ghost and PXE booting to reimage the machines. Build up a master image once - redo it yearly, or quartly, or bi-yearly and you are good to go. Also Group Policy is your friend! If you get into complex software pushes I would look into MS SCCM ( I think that is the name of it now.)

3. For your size I would skip the router and just use the firewall as a "router" (It's really natting across legs but the end effect is the same). You would probably need something in the ASA 5520 range also for a school I would invest int he SCS Module to do web filtering. Also learn how to do VLANs and put each lab into it's own vlan admins in another and servers in yet another.

4. If you can swing a second server go for it, otherwise you should be alright hosting AD, DNS, DHCP, and Files on the same machine. Please stay AWAY from SBS ... pleeasse. Make sure you have a good tape backup system. BackupExec and ArcServe are probably the friendliest for someone new to this stuff.

5. Honestly, google will be your best friend

6. I think if you follow the advice you get from here, and go get some books on AD, Networking, Cisco you should end up with a design that will work very well for you and leave room for future expantion.

7. Good luck, read alot, get some books. and setup one lab first play around learn and model things before you give it the blessing. Possibly if school is in session talk to the teachers (comp sci/ science mostly) and see if you can get a couple of trusted students to come in and try and break things.

Oh and one more thing. Set the machines to boot from PXE, then HD and disable all other boot options, then put a BIOS password on the machines, that way the kids can't boot from cd/usb and be able to undo all your hard work securing the systems!

The problem is probably that your switch doesn't handle correctly multicast groups and then send multicast as broadcast (and so flood your wan link, or at least the wan router) with useless data).
So you must have at least one switch acting as an IGMP Querier, this can be enabled on Cisco 2960 and 3750 with the command ip igmp snooping querier. If your network only has 2950 you will definitively have problem.
You can easily see if your switch are broadcasting the multicast by running wireshark on a PC while you reinstall image on others computers. (you should not see the multicast data if all is working fine)

Please also tell us what multicast IP is used, some are reserved and should not be used, some can be routed and some are not routable (see http://iana.org/assignments/multicast-addresses/multicast-addresses.xml)