Networks

Ask something
Discussion Locked

Remote Domain Setup

0 helpful
1 reply

by kirkd

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Looking for some direction from any who've been down this path already. All server's being used are windows 2003.

We have 3 remote sites with around 10 workstations each on a P2P Network and each site is connected to the main site over S2S VPN using Sonicwall Firewalls.

I want to setup Domains at each site to simply management and resource sharing. I've been trying to go with separate domains and trust relationships but I'm running into issues with consistence authentication. on 1 site I was able to get a forest/transitive trust setup and I can get to resources but I cannot add users/groups to a share in the main network but I can add to shares in the remote site. The other site I tried, 90% of the time I don't get the option for a forest trust and when I do I get an error the remote domain (setting up both from the main) is not at the highest functional level but it's set to the windows 2003 server func level.

The other option I'm now looking into is child domains. I tried to run the DC setup remotely and I got all the way to the end before it crashed (could not contact the parent DC to finish setup).

First I would like feed back on the Pros/Cons of these two options, then some tips on getting them to work?

Thanks,
Kirk

1 reply

by gupnit

Hi Kirk,

3 Remote Sites with 10 workstations each - Well Child Domains / Multiple Domains / Multiple Forests ---- No No No I would never do this !!!

What is your objective - "simply management and resource sharing" Right ?

Your scenario calls for Additional Domain Controller. Here are some benefits of ADC

1. Maintaining a Single Domain with all ADC is always easier to manage
2. In ADC (Single Forest) any change that you will make to your Users/Objects etc either in HeadOffice or Branch Offce will get replicated to every DC server (Reason: Every ADC has full copy of the AD). The issue here is the replication, but I doubt whether you will have so many changes on a daily basis that you will suffer.
3. Also, if any of the DC fails you can jsut start pointing to any other DC as all are ADC. Users travelling across remote sites will not be worried as GC will take care of authentication also.
4. Infact if you have read Microsoft recommendations for most of the organizations a Single Domain AD Forest would suffice and I do not see any reason why you are different.

Only thing is during setup if you use the HO DC Backup to create the ADC then replication would be fast, otherwise depending upon your AD size your ADC setup might take sometime. Steps to install ADC
1. http://www.petri.co.il/how_to_install_active_directory_replica_on_windows_2003.htm
2. http://technet2.microsoft.com/windowsserver/en/library/4aae5014-fbce-42dc-b5f7-e1dde3072f381033.mspx?mfr=true

Now coming back to the management and shareability.....!! Well for each Site create an OU. Under the site OU create sub OUs, for Users, PC, Printers, Admins, Servers etc

Ex:

Site 1 : OU called "London"
Within that OU, other OUs
Users
Printers
Groups
PC
Server

Now you know what to put within these sub OUs, respective objects for every site.
Now, in the Site OU (Ex: London) delegate Permissions to a person whom you want to manage that Site.

Now, you can also create GPOs based upon OUs for each site depending upon what kind of restrictions you want to put.

This kind of a OU based strcuture works very well and is being used across major/large organizations also.

Hope this helps
Thanks
Nitin Gupta (gupnit)
http://www.nitingupta.in

This discussion is closed to new replies.