Home / server / Questions / 341918
Accepted
Mike B
Asked: 2011-12-18 08:34:57 +0800 CST

Best option for branch office - Active Directory domain

  • 772

I set up a 2008R2 AD in a small office (less than 10 users). We are opening a delegation, and I'm studying the different choices for the domain (let's say domain.com). The link between the offices will be a WAN accelerator with an IPSec tunnel, as both of them are connected to Internet through ADSL connection (around 6Mbps/600Kbps). File server and ERP application will remain in the main office.

I've been searching for a comparison chart or a cons-pros list, but I haven't found anything.

First choice, secondary domain. AFAIK, it would imply the creation of a subdomain (branch1.domain.com). Would it also imply that users are different or anyone could log in any of the domains? I guess DNS management would be independent between zones. Any other consideration?

A domain replica is another option, but I'm not very expert, and I fear DNS management of the different offices. On pros, I guess it would speed up login and would make my domain high-availability. But another office will probably be opened, any problem with 3 replicas? I read that replication is made in a ring manner, but links are only point to point with main office, I don't need offices to be seen between them. Would this be a problem?

The third option, a Read Only Domain Controller seems to be the best, as it would have the good thing about replication with no (or less) considerations. It will also have the bad thing about DNS management.

If someone could lighten this up, or point me to a tutorial or something where this things are explained, I would be grateful. I've been reading about the three options, but can't find any comparison between them.

active-directory windows-server-2008-r2

1 Answers

  1. Best Answer

    It sounds like you simply want a new Active Directory Site defining. Pardon me from quoting the documentation, but this describes your situation perfectly in my eyes.

    In Active Directory, a site is a set of computers well-connected by a high-speed network, such as a local area network (LAN). All computers within the same site typically reside in the same building, or on the same campus network. A single site consists of one or more Internet Protocol (IP) subnets.

    You would put your second office in a second subnet and define this in Active Directory. Clients in each site will prefer local Domain Controllers for speed reasons, but will go across the WAN if either the in-site Domain Controller is unavailable or it explicitly requires to speak to a Domain Controller in another site.

    • 4