Creating a VPN That Maps Users to VLANs

We're doing this with Server 2003 where I am. The key is our central layer 3 device (in our case an old 3Com 4900 SX). It has what 3Com calls a "virtual interface" for each vlan. When dhcp requests arrive at the device from the outside it forwards them using same vlan interface they arrived on. The dhcp server just has a scope setup for each vlan with no other special configuration details. It matches the dhcp request to the originating interface on the layer 3 device to know which scope to use. That's out of the box behavior for the windows dhcp server.

The downside to this approach is that segment with your server must now be a member of all vlans (on the same virtual segment). This means all your broadcast traffic will now go up the fiber link to your main office (though not down all the other links to other branches), and it's nice to keep those links as clean as possible. It'll also use time on what is likely already your busiest local segment to reach your server. But this is probably unavoidable anyway.

Update:
Looking again, we do use the 003 (Router) option under Scope Options to match the address of the virtual interface with the correct vlan. That may have something to do with it as well, but I think that really just sets the default gateway.

No, Your Domain Controller does not need to have a network interface for each VLAN. What you will want to do though is setup each VLANs subnet in the MMC Active Directory Sites and Services console and associate them with your "site". This will associate any domain PC on these subnets as being in your AD "site".

You are correct with the DHCP server. It can be on either subnet but you will need to setup the helper-address on your router to point to the IP of the DHCP server. This will enable BOOTP forwarding on the router and allow the DHCP requests to be passed through the VLANS to the correct subnet/ DHCP server.

On your DHCP server setup a scope for each subnet. Make sure you authorize the DHCP server in AD by right clicking it in the DHCP MMC console and selecting "authorize". You will need Enterprise Admin rights to do this.

Also, considering that you already have your subnets set statically with IPs you may want to enable conflict detection on your DHCP server. This will make the DHCP server try to ping an address before handing it out. You can do this by right clicking "IPv4" under the server in the DHCP console and going to the advanced tab. Then set the number of attempts (1-2). Keep in mind that this will delay the handout of IPs while it waits for a response.