I have to make a decision that requires some non-standard working methods in a Windows environment.
First the environment info:
1. My organization has some Windows 2003 servers at a main site, including a Windows 2003/Exchange 2007 server and some citrix servers. We run active directory 2003.
2. We have another site that has a Novell 6.5 server that we are replacing with a windows 2003 server.
3. Users at this remote site get their email across the WAN from our exchange server. They are prompted for AD credentials when doing so. They are also prompted for AD credentials when logging into our Citrix servers. That’s all fine.
The problem:
You would expect that I would add the server at the other location to the domain(and make it a DC), simplifying management and authentication. Unfortunately I am forbidden from doing so. The CIO of the organization has made it aggressively clear that he doesn’t want the additional WAN traffic that might create, nor problems that may occur when the WAN is flakey. (Which is frequent.) This is not open for debate.
So my options are;
1. create a seperate forest/domain at this site, or
2. leave it as a workgroup server.
I like the idea of the centralized management that a domain server presents, but I worry that if users are logged and authenticated to that domain, they will have difficulty logging into and authenticating to the citrix server and exchange server of our forest/domain. Is that a legitimate concern?
What is my best option when I am not allowed to put the server in the same forest or domain as the main site? Do I have to just setup the remote site server with local users and groups? Or is it not a problem to have users login into one active directory and then authenticate to another for access to email and citrix?