Windows – Best practice for two site Active Directory through VPN

I'm thinking that Universal Group Membership caching is what you need to look into.

http://technet.microsoft.com/en-us/library/cc816797(WS.10).aspx

http://www.windowsnetworking.com/kbase/WindowsTips/Windows2003/AdminTips/ActiveDirectory/Whentouseandnotuseuniversalgroupmembershipcaching.html

This is a little tricky for a couple of reasons. First, let me outline how you make the sites, then I'll explain why it's tricky.

To make the site:

• Create a site object for each physical site that you have that has a DC in it.

• Create subnet objects for all of them based on their IP space (if your sites share a subnet, you don't do this and you won't benefit from using sites). You can assign multiple subnets to a single site.

• Add the subnet that VPN users get assigned to the corresponding site that has the DCs that you want them to use.

• Create site links between the sites so that you can set a replication interval and all that other fun stuff.

• Move Domain Controller objects into the appropriate sites.

This is a well documented thing and you should really read through the documentation to get a feel for it. Sites have a big impact on things like replication, DFS referrals, Exchange/Outlook, and plenty of other things.

Why is it tricky? Well, when a client first logs on to a domain, it uses a random domain controller. Then, it becomes "site aware" and knows that it belongs in a specific site. It caches this information and continues to use it. If that machine moves to a different site, it will first try to authenticate to the old one and one it does, it will realize that it's in a new site and update its cache for future logins. If these are laptops that rapidly change which location they're in, you might not see a lot of benefit - you should still set up sites though, it's best practice.