Domain Controller placement for Branch sites

aideb used Ask the Experts™

I am trying to ascertain whether we need to be placing domain controllers at sites or whether a centralised model is feasible.

We are running 2003 Native mode Active Directory. We have a number of sites which are supplied with 1Mb SDSL links back to the datacentre.

We are looking to avoid placing a domain controller at each of the sites to minimise the amount of tin around the estate. The file server would not be part of this centralisation nor would print services as they would be provided by a small NAS solution.

The number of users at these sites tends to be around the 20 - 30 mark. They also use Outlook / Exchange.

Should I be worried about the relatively low bandwidth? Is there any tests that I am do to simulate the network bandwidth required to login?

I have looked for recommendations from Microsoft but cannot find anything. I had read that they are not willing to publish such documentation??? I guess I am therefore looking for some real life information.

Any help would be invaluable


Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
hello aideb,

it can be centralized.. however i would look at the number of users authenticating /working from remote sites
if that number is higher.. i would considering placing a dc in the remote site and schecule replication during night hours
aditionaly for better exchange performance i would have dcs and a GC where ever you have Exchange installed (if at all you have them in remote sites)

also to avoil log on faliures if the wan is down i would  recomend to have a local dc and  universal group membership caching enabled on this site... oh here
this will enable you to restrict logon request at the local site.. without haveing a global catalog in the local site
that would have otherwise consumed BANDWIDTH
and not all office need to be the active directory sites (depending on users.. login in )

The dc is required when you have atleast 50 users per site along with critical application.
The GC is required once when users login into domain & the info is cached for further login.
Exchange depends on AD for users as well as authentication,so make sure OWA is always accessible through internet.
The authentication max packet size is 1MB to 10 MB.
Since there is no file server & print services & you are using AD & exchange for authentication & mail then  you will face some slowness.
If you have some near sites you can try to authenticate near branch sites to them instead of far sites. Check the primary & alternate dns should work properly & no other application is installed on dns server. Make the RAM & processor enough to process request.

In future you would be required to introduce dc for fast login.

I think w/o dc at each site it should work with some slowness.

You can use netmon, wireshark tool to monitor bandwidth.

Short answer: Yes you can centralise it but shouldnt in many cases.

It all depends on how business critical the branch sites are.
If they are important, you need a DC/GC for each 'site'

Main Centralising Advantages:

-Save costs on hardware/software
-Easier to manage (less replication and planning etc)

Main Centralisiing Issues:
-Entire branch site dependant on SDSL link (no link, no domain, no login, no shared resources, no e-mail flow)
-Bandwidth can suffer under certain circumstances (domain traffic flows pretty much constantly, not just during logon)

If the branch sites have their own DC/GC, most of their functions would continue even if the link was down.
If the branches rely on the SDSL line, they would suffer downtime if the link was down.

Top Expert 2013
have you looked in the branch office guide

Not sure if there is a recommendation in there or not but like others are saying it depends.

How much is that NAS solution going to cost you?  the reason I bring that up is what we are doing for some of our branch offices is buying one beefier box and virtualizing the domain controller and file server (and in some locations app servers) on a box with Hyper V.  




Thanks for all the input

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial