Regarding AD Domain controllers and remote branch offices

Question

We have central HQ building and a lot of small branch offices connecting via VPN and want to implement AD (If you can believe we still haven't). We want everyone to log in using domain accounts and be policed centrally.

We are OK with having a RODC in a branch office with like 10 computers. But we have these small branches with two to four PCs only. Some of these branches connect to HQ via IPSec site-to-site VPN, some via remote access (client-based) VPN.

So there is no problem with ones that have local RODC or connecting to HQ DCs via VPN router. But how about small branches? We don't really want to set up a machine there, neither we want to invest into Windows Server licenses or fancy network equipment.

Also, the problem is that we cannot access HQ DCs via VPN because we are not logged in and connected to HQ internal network yet, so DCs aren't reachable.

What is typically done in that situation if it is needed to have central management over policies on those PCs? Or is it better to let 'em loose and use local policies and accounts in this situation?

Answer 1

DirectAccess would be ideal for you, but requires a certain amount of infrastructure at HQ.

First, I would set up site-to-site VPN links from every site to HQ. No money for fancy network equipment? That's absolutely fine, as an IPSEC site-to-site VPN is not a fancy or demanding endeavour, you can do it with whatever SOHO routers take your fancy (we use Draytek).

Now you need to test your bandwidth and latency from branch office to HQ - there's a trade-off you're going to have to decide here between slow-logins and implementing group policy. Scoping your GPOs carefully should help. If latency is bad then you may have to settle for only authenticating to HQ DC once, applying policy then and then taking down the site-link and using cached credentials for login. (The users are fine logging in with cached credentials indefinitely if no DC is available).

You won't necessarily get all your GPOs to apply out of the box, as the GP client detects a 'slow link' and prevents application of some GP settings (such as folder redirection, software installation). Slow Link Detection

Also, the problem is that we cannot access HQ DCs via VPN because we are not logged in and connected to HQ internal network yet, so DCs aren't reachable.

I don't understand what you're saying here. If necessary you can set up a VPN on the user's PC and they can connect it before logging in.