2

I want to be able to map my VPN clients to a domain controller. For these clients, I am seeing the Netlogon eventid 5807 (client machines who IP addresses dont map to any existing sites in the enterprise).

These machine connect via a sonciwall VPN. The VPN at the main site configures the dhcp for the clients on the vpn client side. Subnets for these locations are not yet defined in AD.

I want to be able to specify which domain controller these computers log on to. I have several domain controllers in the network and some are in different locations.

I attempted to set this up in Active Directory Sites and Services, but I couldnt get it figured out. I am not sure what needs to be created first, I cannot create a site without a site link and I cannot create a site link without a site. Since there is no DC on the VPN client side, I am not sure how to do this or even if I can.

Improve this question

1 Answer 1

Reset to default
3

This is a little tricky for a couple of reasons. First, let me outline how you make the sites, then I'll explain why it's tricky.

To make the site:

  • Create a site object for each physical site that you have that has a DC in it.

  • Create subnet objects for all of them based on their IP space (if your sites share a subnet, you don't do this and you won't benefit from using sites). You can assign multiple subnets to a single site.

  • Add the subnet that VPN users get assigned to the corresponding site that has the DCs that you want them to use.

  • Create site links between the sites so that you can set a replication interval and all that other fun stuff.

  • Move Domain Controller objects into the appropriate sites.

This is a well documented thing and you should really read through the documentation to get a feel for it. Sites have a big impact on things like replication, DFS referrals, Exchange/Outlook, and plenty of other things.

Why is it tricky? Well, when a client first logs on to a domain, it uses a random domain controller. Then, it becomes "site aware" and knows that it belongs in a specific site. It caches this information and continues to use it. If that machine moves to a different site, it will first try to authenticate to the old one and one it does, it will realize that it's in a new site and update its cache for future logins. If these are laptops that rapidly change which location they're in, you might not see a lot of benefit - you should still set up sites though, it's best practice.

Improve this answer
10
  • The OP shouldn't have to manually create site links. The KCC should generate the intrasite replication topology automatically. The KCC running on the ISTG in each site should generate the intersite topology automatically. All the OP should have to do is to create the sites and subnets and move the DC's to the appropriate site container.
    – joeqwerty
    Nov 30, 2012 at 15:04
  • Do you have any documentation that recommends not configuring site links? I've always been under the impression that creating them and assigning sites to them is best practice (and MS AD certification exams test this way). Are you sure you're not talking about assigning bridgehead servers (which the KCC/ITSG will do automatically and is usually just fine to leave on autopilot)?
    – MDMarra
    Nov 30, 2012 at 15:07
  • No I don't. When creating a new site you have to select a site link object for the site. There's only one by default (DEFAULTIPSITELINK). It's not possible to create a new site without selecting a site link and the only choice (if no other site links have been created) is the default DEFAULTIPSITELINK, so no manual site link creation is required unless you plan to create site links based on your WAN topology. Do I have this wrong or am I misunderstanding something?
    – joeqwerty
    Nov 30, 2012 at 15:30
  • I've only ever created site links based on the WAN topology, so that I could have granular control over replication intervals and site link cost for replication to the DR site as well (think hub-spoke with two hubs). Honestly, I didn't even realize that a default site link was created. Seems like either way would work if the OP doesn't need granularity in the link settings.
    – MDMarra
    Nov 30, 2012 at 15:37
  • 2
    You don't need to create a new site for your VPN clients. Just add their IP subnets to the already existing site that hosts the DCs that you want the VPN clients to authenticate to. You don't even have to think about site links at all. Site links are for inter-site replication among DCs, which is not what you're concerned with right now.
    – Ryan Ries
    Nov 30, 2012 at 17:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .