allow external computers to access the DC or domain users

[taxman]

hello,

 

this is my first post. I'm sorry if i posted in the wrong area.

 

I want to allow an external server to be able to use Domain Users or Authenticate the users with Active Directory. I don't want to have to use VPN. How can that be done?

 

Currently we have a couple applications installed on the external server that uses active directory. The way it works now is that, that external server needs to VPN to the network all the time so that the active directory users can be authenticated.

 

How can I make it work or which technology needs to be used so that it will still authenticate ? ADFS? create a trust between the external server and the internal DC? how?

 

Both of the servers are 2008 R2.

[Firefox]

Do you have control over this external server? If so you will have to consider putting a trust in place (through Active Directory Domains and Trusts) Depending on what the application is and how it works, I would consider a 1 way trust, so that your external server trusts your DC, but not the otherway round. I would also make this trust non transitive

[Geoff]

You still have to route this over a VPN, most ISPs block netbios.

[taxman]

Firefox: I do have control over the external server. So I will need to also install AD DS on the external server to make the trust work?

 

Geoff: I will need to route it over VPN to setup above or you're saying I will still always need a VPN connection? The problem is the external server have applications that use Active Directory users from our internal servers. Once the VPN goes down the users can no longer be authenticated and that's where my problem arises from users.

[Geoff]

I wouldn't expose AD services like SMB/LDAP/Kerberos to the general Internet if could help it. Tunneling over a VPN is the right approach. Maybe look at why your VPN dies and fix that instead?

[taxman]

Thanks Geoff

 

The VPN dies because too many users (developers) have access to the server. When there are too many active sessions on the server someone kicks off the account that has VPN logged in. I've asked many times not to kick off the VPN account but it still happens.

 

Any way I can restrict something like that?

[p858snake]

So developers have direct access to a live server is your issue?

[Geoff]

You mean RDP sessions?