asked on

AD subnets VPN

I need to set up a remote location that authenticates AD to the DC at the main office. There is no on-site DC. I have the VPN setup to the remote office. On the firewall I have DHCP giving the secondary DNS to the Main office DC. Should this work? Do I need to add anything about the co-locations subnet at the DC in the main office?

Julian123

I'd recommend the following:
1. Ensure your primary DNS server is an AD-integrated DNS server in addition to your secondary. Typically, folks use DCs as DNS servers but this isn't required (it could be an AD-integrated DNS server that isn't also a DC). The best practice is that the DNS server has all the records used by workstations to find domain controllers to authenticate and having DNS be AD-integrated helps ensure that will happen.
2. Set up your AD sites and services subnet to associate the subnet used by the remote office with the DC at the main office. This ensures that machines in that remote office will connect to the DC(s) in the main office and not some other DCs that could be in another remote office (if you have one).

Thanks!

WIZU2

ASKER

I know how to add the additional subnets, but how do you make it associate?

ASKER CERTIFIED SOLUTION

N-W

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Sandesh Dubey

Also ensure correct dns setting on DC/clients as this

Best practices for DNS client settings on DC and domain members.
http://abhijitw.wordpress.com/2012/03/03/best-practices-for-dns-client-settings-on-domain-controller/

To associate the subnet with a site see this:
http://www.activewin.com/win2000/step_by_step/active_directory/adsites.shtml

WIZU2

ASKER

Ok the second DC at the remote location is in a different time zone? The DC is pulling the time from the main office. How do I fix that issue?

SOLUTION

N-W

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

WIZU2

ASKER

I set the second DC at the remote location to the right time zone. But now the DC at main office is complaining about the time difference event ID 1925.

N-W

Are you able to post the full event error message?

ID 1925 usually refers to DNS lookup issues regarding AD replication.

It may be worth resetting the NTP configuration on your secondary DC too:

net stop w32time
w32tm /unregister (enter this command twice if presented with an error)
w32tm /register
net start w32time
w32tm /config /syncfromflags:domhier /update
net stop w32time && net start w32time

Open in new window