I have an existing AD domain with numerous sites. Currently, we are allowing AD replication through the firewalls with the "swiss cheese" method, allowing RPC, etc. To trim this down, we would like to start using IPsec encapsulation for AD replication between DCs. I'm currently following this article:
There is one discrepancy in that article that is troubling me, however. It says that I need to go to:
Start | Programs | Administrative Tools | Local Security Policy
However, this is not available on a domain controller. I only have 'Domain Security Policy' and 'Domain Controller Security Policy'. If I start defining ipsec policies using the 'Domain Controller Security Policy' link instead of 'Local Security Policy', won't those policies get replicated to all DCs? Will that be an issue?
Ideally, I'd like to enable ipsec on certain DCs as a test, and roll it out to other DCs as I verify it's working. I don't want to do a global ipsec configuration and activate it on every DC simultaneously.