As I understood the joined to Windows AD computers are always securely identified/authenticated before DC (using automatically changed computer accounts passwords).
Now, I read (in non-English article) that IPSec always should be configured in AD. Why is it? Suppose that AD is well secured from internet or even doesn't have internet connection in tight company environment.
When is IPSec "must" for AD?
BTW, why are the secure authentication of AD computers always needed? Can DC be configured for insecure authentication of computers (for ex., in small development/testing environment)?
----------
Update1:
Having this very secure, very flexible, very easy IPSec, how the hell to fall back to insecure AD computers?
Do I understand correctly that this secure authentication of AD computers makes impossible
- single-sign-on between workgroup users and AD user accounts
- RunAs and secondary logon with AD user account in workgroup Windows (and vice versa)
which is the pain in the ass for development or tiny companies infrastructures. This inflexibility does not make much sense (having IPSec)?