DC at remote sites or not?

[techie17]

Currently we have all schools in our MAT on the same network (connected via S2S VPNs) with the DCs located at a single school. Currently, other schools all use the DCs at the “main site” and don’t have an on premise DC. Does anyone else adopt this. Approach or is it wise to put a DC at each site? The main site has a 200mb leased line and the other sites are 80/20 FTTC so what worries me is the DCs at the remote sites becoming out of sync.

 

Thanks

[Primus]

Personally I'd put a DC at each site - the traffic will be so minimal sync should not be an issue.

[3s-gtech]

Personally I'd have a DC at each site. If the link goes down, users can still authenticate and log in (depending on other services of course, like storage). A DC doesn't take much time to set up or maintain.

[FN-GM]

I am in the process of removing domain controllers at our 20 remote sites. All our servers will be all central. Keep it as simple as possible.

 

It was only this weekend one site had a power outage. Luckily it was a local site and not one that is an 8 hour drive.

 

One pain about having DC everywhere is there will be a minimum of a 15 minute replication delay on password reset from another AD site.

Personally I'd have a DC at each site. If the link goes down, users can still authenticate and log in (depending on other services of course, like storage). A DC doesn't take much time to set up or maintain.

In the advent of cloud they won't be to do much anyway. They could login but not get email etc. They might not be able to get files unless you replicate to the on site DC.

[3s-gtech]

Yup, that's the downside. I have a single remote site - but it has most services on-site there so having DCs makes sense. Email and SIMS would be offline if the link went down though.

[techie17]

Thank everyone. To be fair out email is cloud, files are in the cloud and MIS is in the cloud so it just a case of how often the internet goes down at each site which if I’m honest, is hardly ever.

[EddyAllen]

Microsoft best practices would be just to have a RODC at a remote site. You could also put a DC in Azure connected by a s2s VPN if you want some extra availability.

[dmj]

Microsoft best practices would be just to have a RODC at a remote site. You could also put a DC in Azure connected by a s2s VPN if you want some extra availability.

 

 

I'd advocate this approach; but I would have a RODC at EVERY site and use two cloud providers to host the DC's.

 

BTW @EddyAllen why use VPN ?Does LDAPS / SMB3 not cover this ?

[techie17]

I was told and IT company that if I put a RODC at each remote site, would that cause issues for those users that roam between sites. I thought that was incorrect but is that true? Also if I were to host a DC or two in the cloud what would be the rough cost of this per year?

 

If a RODC was at the remote sites, does it still store info in AD from the remote site, such as login information etc and then write that back to the main DCs? I'm guessing you would still have DNS on the RODC's?

[3s-gtech]

RODCs do no write-back - they’re Read Only. The issues you may have would be to do with sync time, I imagine, which has a default of 15 minutes. I’ve never bothered with RODCs, and just put in regular DCs/GCs.

[EddyAllen]

I'd advocate this approach; but I would have a RODC at EVERY site and use two cloud providers to host the DC's.

 

BTW @EddyAllen why use VPN ?Does LDAPS / SMB3 not cover this ?

 

I just use that for simplicity and I suppose it lets you have a DC that isn't public facing in any way.

 

You can change the sync interval in the AD Sites and Services MMC. Some things are pass-through, eg password changes; if you change your PW it will send that request to the RODC which then forwards it to a 'normal' DC. If its a remote site, the chances of you being able to get to a physical location that would have a sync issue are pretty slim. If you are using separate domains for each site in the same forest, make sure to have the RODC as a Global Catalog server otherwise you will only get details for the domain its set up for.

 

I think in an Education enrionment the MS best practices are fairly moot tbh as RODCs are primarily for security.