Solved

Server 2012 VPN S2S and Active Directory Best practice without servers at each location

Posted on 2015-02-12
4
131 Views
Last Modified: 2015-02-17
I've setup SonicWall TZ215's with site to site VPN's and had luck using a central AD server without local AD servers on each location, but ran into the once in a blue moon losing trust issues. Does anyone have a best practices opinion on such a setup with many small locations needing AD to access the central server? The next company is looking at 15 locations with about 6 computers/users each. Should I just go with the way I've used in the past to save them an expensive server and setup costs, or should I push for a server at each location? Pro's and Con's of each would also be appreciated.
0
Comment
Question by:Josh Garrett
4 Comments
 
LVL 53

Accepted Solution

by:
Will Szymkowski earned 167 total points
Comment Utility
For anything under 15 users I would not put a DC in that location, for licensing purposes. If you have larger sites that have a DC at them you could configure sites and services to authenticate with a particular site based on Geographical location. This way it will not just try to authenticate from and DC that is can find.

Personally I would leave it the same as you have it already. You usually only have DC's in a remote site when there are 20+ users (depending on the WAN connection). I have seen remote sites with 30+ users with no DC local and it worked fine. They had local file server and whcih also acted as a DHCP server and it worked fine.

It really all depends on the connection to the main site.

You would also have a DC local if you were hosting application services like Exchange where you require a DC in the site itself. I am assuming that with 6-10 users you are not going to be hosting Exchange.

RODC is also an option but once again not worth it for 6-10 users.

Keep it the same.

Will.
0
 
LVL 37

Assisted Solution

by:Bing CISM / CISSP
Bing CISM / CISSP earned 167 total points
Comment Utility
> should I push for a server at each location?

i think the 'server' here is for DC server. but how how about other application servers and file servers if any? and as mentioned above, how many users are there for each site?

the answer you are looking for is actually based on your business requirements which somehow can be represented by the network resources (e.g. as asked above) currently arranged at the head office and its branches.

so btetter more details please?
0
 
LVL 12

Assisted Solution

by:Dave
Dave earned 166 total points
Comment Utility
I haven't seen any "loosing trust" issues with site-2-site VPN. The issues I have seen have been with ADSL and long logoff on times with roaming profile as its saved at logoff, and slow document save times.

As others have said the proper design depends so much on the business requirements, which then drives the technical specification.

So in this case do they really need local hardware access, if not then solutions like Terminal Services/Citrix/Client Virtualization can be cost effective.
0
 
LVL 1

Author Closing Comment

by:Josh Garrett
Comment Utility
Thanks guys, the reassurance was great.
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

Every server (virtual or physical) needs a console: and the console can be provided through hardware directly connected, software for remote connections, local connections, through a KVM, etc. This document explains the different types of consol…
Synchronize a new Active Directory domain with an existing Office 365 tenant
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now