We help IT Professionals succeed at work.

We've partnered with Certified Experts, Carl Webster and Richard Faulkner, to bring you two Citrix podcasts. Learn about 2020 trends and get answers to your biggest Citrix questions!Listen Now


AD design advise

NickGT20 asked
Medium Priority
Last Modified: 2010-04-18
I'm trying to design a network. Here is my plan, tell me what you think.
Site A
Forest Root, Domain Controller, Exhcange, SAN.

Site B
Connected to Site A via VPN over T1. Joined to the domain in Site A and grouped as a Site in Sites and Services.
It would have it's own DC.

Site C
Currently only connected via the internet, RDP. Will eventually have a site to site VPN to Site A.
May or may not have it's own DC. Joined to the same domain in Site A and segmented into a site via Sites and Services.

This way I can schedule replication for off peak hours between the DCs and still administer everything from one location. Our main goal is something that can grow quickly with us. Right now there is only one Admin at site A. In a year from now we foresee the need for another admin at Site B. Would this design allow to quickly move to seperate domains or child domains under the same forest?
Watch Question

Chris GralikeSpecialist
If you suggest a forest spread over multiple locations as in;

                                      mycorp.local  (main location)
                                          /    \
                                       /          \
                                /                       \
             siteB.mycorp.local            siteC.mycorp.local

Yeah it should allow quite easy growth. and if im not mistaken is also the way microsoft advices to set up multiple sites in an forest...


Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts
Chris GralikeSpecialist

But why do this manually and not while promoting the new domains in the forest as new domain in exsisting forest?

Top Expert 2006

unless you have a specific need for child domains then the above design is fine....make sure that you configure a site within AD for each site that you have and that you have a minimum of 1 DC and 1 DNS server per site as well as a GC


Well, what I have is a DC with DNS and GC at site B and Site A.
Is it mandatory that site C have a DC? I thought it can still authenticate through the VPN to either Site B or Site A?
I hear conflicting reports as to whether I should just do Sites or child domains. As I am  the only admin right now I want it to be easy for me to administer users and email. We only have one Exchange server right now. Site B has an exchange server that isn't in use right now, but will most likely get used once I get to configure it. If I can set up child domains and still have users replicated between the domains that would be good, and they still all need to use the single exchange server for now. And I want all the mail to look like it's coming from mydomain.com not sales.mydomain.com.
Top Expert 2006
well child domains are not for you in this scenario, you are basing purely on sites so there is 0 need whatsoever, child domains dont replicate with other sites, what you want is a DC in each site for you current domain and let it replicate. One exchange server is fine, have this at your root site.

You dont have to have a DC at site C, but it will make life a lot easier for you and chew up much less bandwidth as well as making everything perform faster

Child domains are where you have like separate parts of a company. Eg, last mob i worked for had a national office (Domain.com) then sub domains for each state which had its own database of users and groups and security etc. (state1.domain.com, State2.domain.com) Each sub domain was an individual business that did not need to replicate anwywhere......


Thanks guys.

Top Expert 2006

not a problem
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.