Domain – Accessing domain controller in data center

active-directorydomaindomain-name-systemldapmicrosoft-forefront

We used to have a domain controller in our local office network. Now we have moved the servers to data center and the dc is there, behind the forefront TMG firewall.

In order for my office computers to be able to authenticate to the domain, I have the following options that I know of:

I can VPN into a data center servers network (vpn gateway is set up inForefront TMG) and authenticate as if I am in the local network with the domain. Ho can I setup VPN clients in Windows 7 to connect via vpn automatically at login?
I can publish the DC's Active Directory integrated DNS server via Forefront Publishing rule. Set up my local network to use this DNS, so that the DC can be found. And allow LDAP traffic through Firewall.

Which one of these approaches is better?

Best Answer

The VPN option is better, since you won't be exposing LDAP to the outside world unnecessarily.

Side note, I'd want at least one domain controller at my local site. If your link to the data center goes down, you're screwed.

Related Solutions

Windows – Can’t log in using second domain controller when first DC is unreachable

Check to make sure that BOTH are Global Catalogs.

Howto:

1.) Open Active Directory Sites and Services.

2.) Scroll down, expand the site that your DC's are in. Expand
`Servers'.

3.) Expand each of your DC's so that they're showing `NTDS Settings'.

4.) Right-click on 'NTDS Settings', select `Properties'.

5.) Ensure that the `Global Catalog' checkbox on each is checked.

DISCLAIMER:

I'm assuming that you've already checked your replication, made sure everything else is working properly, etc. This is intended to be a quick-check option.

Share the same subnet between Internal network and VPN Clients

I have never used Forefront, but using the same IP range for your VPN clients as your internal network only complicates issues. (as you are finding out) You should use a different range for VPN clients, and just have the Forefront box hand them their DHCP IPs instead of passing their requests to your internal DHCP server. Having the VPN clients "use their own internet" is accomplished through split-tunneling, which I am sure the Forefront box should be able to accomplish.

Best Answer

Related Solutions

Windows – Can’t log in using second domain controller when first DC is unreachable

Share the same subnet between Internal network and VPN Clients

Related Topic