disk Posted December 6, 2017 Posted December 6, 2017 I am looking to standup a Citrix XenDesktop implementation in Azure. Currently, we have two domains on campus (parent for staff/faculty, and child domain for instructional areas). I'm thinking the best way to go about this is to create two new domain controllers within Azure and then configure a site-to-site vpn for replication. At this point, are there any gotchas that I should be aware of? This is my first foray into actual cloud work. We would also need to create a new site within AD as we would not want on-campus PCs going out to Azure to authenticate and receive group policy, etc. Any one doing anything like this? Is it possible to replicate just specific OU's or should it not really matter? I'm assuming we should have a copy of the global catalog in Azure too? I would love to hear from anyone that has gone through this process already. Things to look out for or things we need to consider? Thanks!
Blue_Cookeh Posted December 6, 2017 Posted December 6, 2017 Sounds like you could do with consolidating your existing domains, really! So long as you setup your AD sites and subnets properly there shouldn't be any reason why it wouldn't work, just make sure you plan for file access properly since you could end up syncing user data in and out of Azure. I can't imagine this would be very cost effective, a decent XenDesktop host in Azure would be $$$$.
xenonive Posted December 7, 2017 Posted December 7, 2017 If you only want it for back you should look at Azure site recovery https://azure.microsoft.com/en-gb/services/site-recovery/ you can back up VMs to Azure and in event of failure boot them in Azure to work over site to site VPN . Cost is about £25 a cold VM per month
snagrat Posted December 7, 2017 Posted December 7, 2017 We do this currently. Costs about £60 per month and we have 12 schools connected to it. Not had any real issue with it since it went live about 18 months ago
disk Posted December 7, 2017 Author Posted December 7, 2017 Sounds like you could do with consolidating your existing domains, really! So long as you setup your AD sites and subnets properly there shouldn't be any reason why it wouldn't work, just make sure you plan for file access properly since you could end up syncing user data in and out of Azure. I can't imagine this would be very cost effective, a decent XenDesktop host in Azure would be $$$$. We've discussed domain consolidation but the security settings alone are currently a show stopper. Our students are in OpenLDAP and have no AD accounts (this is something myself and a few others have been pushing for). So in our lab environments, we use generic domain accounts, most autologon with no password.
disk Posted December 7, 2017 Author Posted December 7, 2017 We do this currently. Costs about £60 per month and we have 12 schools connected to it. Not had any real issue with it since it went live about 18 months ago Awesome! Did you end up standing up DCs in different Azure regions for high availability? Did you ensure one of the Azure-hosted DCs had a copy of your global catalog? What kind of vpn solution did you end up using for AD site replication with your main campus?
disk Posted December 7, 2017 Author Posted December 7, 2017 If you only want it for back you should look at Azure site recovery https://azure.microsoft.com/en-gb/services/site-recovery/ you can back up VMs to Azure and in event of failure boot them in Azure to work over site to site VPN . Cost is about £25 a cold VM per month We already have a DR site elsewhere. This Azure hosted extension of our domain would be to serve our XenDesktop implementation that we want to move to the cloud. Basically, we will have a number of Windows Servers running in Azure that need to be AD joined and managed.
snagrat Posted December 7, 2017 Posted December 7, 2017 Awesome! Did you end up standing up DCs in different Azure regions for high availability? Did you ensure one of the Azure-hosted DCs had a copy of your global catalog? What kind of vpn solution did you end up using for AD site replication with your main campus? We only have one in Azure currently but plans to add more. The Azure DC is the GC. Replication is set to 15mins to all other DCs in the schools. We use Fortinet and use the IPSEC VPN to create the Site-to-Site VPN. All free on the Fortinet side and then you pay per resource in Azure
disk Posted December 7, 2017 Author Posted December 7, 2017 We only have one in Azure currently but plans to add more. The Azure DC is the GC. Replication is set to 15mins to all other DCs in the schools. We use Fortinet and use the IPSEC VPN to create the Site-to-Site VPN. All free on the Fortinet side and then you pay per resource in Azure Nice! Thanks for the info.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now