Dedicated VPN with AD

A current project i am working on is a migration from a Workgroup to a Domain. With that being said, will having a dedicated VPN to all remote sites still need a DC at each site? I plan on installing one backup DC if a one is not needed at each remote site.

Thanks for the help!