Domain Controllers - Separated by long distances

Posted on 2013-12-05
Last Modified: 2014-01-22
Hello All,
My company is thinking about opening a new office in the UK and because of this, I'm thinking about how my domain hierarchy is going to change.  Our HQ is located in the states and I am concerned about how to go about setting up a domain controller for this office in the UK.

What are some of the obstacles I'm going to have to look out for because of the distance between domain controllers?

I'm thinking about creating a new sub-domain that has a two-way transitive trust between the two.  That way if we have other remote offices appear in the future we can add another sub-domain off the forest root and configure the same way as the first allowing the two sub-domains to have trust each other as well.

Your thoughts?
Question by:tnims
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 57

Expert Comment

by:Mike Kline
ID: 39699382
How is your current forest setup, it is it a single domain.  A domain for the UK is a common way to do it.   Or call it Europe for future expansion.

How big is your current AD?  Do you know what network connectivity will be like?


LVL 37

Assisted Solution

Mahesh earned 100 total points
ID: 39699403
if you have explicit requirement to separate existing AD domain, then only go for child domain
For example, if you want to have separate domain in same forest due to some legal, business, security reasons.

Otherwise single domain single forest is best from management point of view and to maintain simplicity and avoid complexity.
You can deploy ADC at all new locations if required.
You can delegate administrative task OU wise at those remote locations.
More even you can deploy RODC if user base is less than 100 and physical security is less.

Apart from above there is one concept call empty forest root and add child domain as resource domain and then expand child domain to all remote locations.
Since this concept will not work in your case as you already have single domain single forest and do not required unnecessarily creating child domain and migrating all resources from parent domain to child domain.


Author Comment

ID: 39699421

Existing Domain is:
UK Domain would be:

The two domains would connect via VPN tunnels (Dell SonicWall)

Current Size:

Domain Controllers:  (Site ADC)   --  Datacenter  (Site TXO)   --  Texas Office  (Site NCO)  --  NC Office  (Site: ADC)  --  Datacenter


Note:  After the UK domain controller is configured, I'm going to start to config a new Exchange environment that is only related to   -- totally separate from exchange environment on
Migrating Your Company's PCs

To keep pace with competitors, businesses must keep employees productive, and that means providing them with the latest technology. This document provides the tips and tricks you need to help you migrate an outdated PC fleet to new desktops, laptops, and tablets.

LVL 37

Assisted Solution

by:Jamie McKillop
Jamie McKillop earned 100 total points
ID: 39699478

If you plan to build a separate Exchange environment, you need a separate AD forest. There can only be one Exchange organization per forest.


Author Comment

ID: 39699633
How do big corporations usually handle these types of scenarios?  Do they create new forests for each geographical region and use trusts between forests?

We don't want large amounts of AD traffic and exchange traffic to be routed across the WAN, etc.  This is the reason I'd want to create a new exchange environment for the UK region.  

What I do want is for the people traveling between the US/UK region to be able to access the same resources on each separate domain/forest.
LVL 57

Assisted Solution

by:Mike Kline
Mike Kline earned 100 total points
ID: 39699649
We have a few foreign offices but they are in our domain.  We also have good bandwidth and they are a separate AD site.

How big of an environment are we talking about?


LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 100 total points
ID: 39700110
Personally if possible I would not recommend setting up a child domain. This will leave you with more administrative effort and more complex scenarios when trying to do upgrades to later versions of AD. What would be the exact reason for a child domain? How are you going to benefit? Most of the reasons to have a child domain in the past was to accommodate multiple password policies, which is now resolved in 2008R2 and up domain's.

If you are worried about latency issues you can modify your replication schedules so that AD changes replicate during non business hours or as radially as you like (15 min intervals max).

 I have administered AD domains where we had data centers in Vietnam and high latency lines but due to the time difference we could set replication intervals to accommodate our needs.

LVL 24

Accepted Solution

Sandeshdubey earned 100 total points
ID: 39700196
Avoid having a multi-domain forest - instead, plan to have single domain forest and unless you can come up with a compelling reason to create additional domains, leave it as such. In pre-Windows Server 2008-based AD, creating multiple domains would typically be necessary to accomodate different password policies - but, with the introduction of Fine Grained Password Policy in Windows 2008 DFL, this is no longer the case.As the connectivity between HQ and UK is good stick to single domain.You can delegate control for UK team to have access to AD as per business required.Enusre that DNs/GC role is enabled on all DCs.

The following articles could be helpful to design the AD structure:

Determining the Number of Forests for Your Network

Determining the Number of Domains Required

In general it is recommended that at least two DCs in a domain for high availablity and fault tolerance, but how many DCs at each site will depend on your requirement. Normally one DC at each site can serve thousands of users with regard to authentication.

You can read MS article and the previous discussion:
Domain controllers # Determining the number of domain controllers you need

How many domain controllers are recommended

Featured Post

Ready to get started with anonymous questions?

It's easy! Check out this step-by-step guide for asking an anonymous question on Experts Exchange.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Did you know that more than 4 billion data records have been recorded as lost or stolen since 2013? It was a staggering number brought to our attention during last week’s ManageEngine webinar, where attendees received a comprehensive look at the ma…
Had a business requirement to store the mobile number in an environmental variable. This is just a quick article on how this was done.
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question