Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a Windows 2008 Active Directory setup such that we use the same password on multiple machines etc.

Now we have a server (Win 2008 R2) located offsite and therefore also outside our firewall and we wish to attach the machine to the domain.

I'm thinking that a VPN connection of some kind would allow us to join the external server to our domain.

  1. Which type of VPN (PPTP, IPSec, ..) would you recommend (single server) for this purpose?

  2. Or is there another possibility which makes more sense?

share|improve this question
up vote 1 down vote accepted

If you can't set up a direct link between your LAN and the remote site, then a VPN is your best option. You can set it up basically in two ways:

  • Have the server establish it.
  • Use a site-to-site VPN.

In the first scenario, your server will establish the VPN using its RRAS service; it will be the only computer that will be able to talk to your network. You shold use RRAS instead of a standard user-space VPN connection because otherwise that would require a user to log in and activate the connection in order for it to work; RRAS will handle that automatically.

In the second scenario, you'll have a router/firewall at the remote site establish a VPN connection to your network; this will let many computers at once talk with it, and it is normally preferred because it's more reliable, manageable and secure than having single systems doing that.

In both scenarios, you'll need a VPN server in your main network; this can be a router, a firewall, a Windows server running RRAS or ISA/TMG... almost anything you want; it could also be your current firewall, if it supports VPN connections.

L2TP/IPSec VPNs are usually more secure and reliable than PPTP ones.

share|improve this answer
I ended up doing a site-to-site VPN between our site and a (virtual) router in front of the (virtual) server. I did take a brief look at the Windows 2008 VPN services but it seemed very complicated to setup compared to site-to-site vpn. Thank you for your advice. – Michael Jacobsen Aug 6 '10 at 8:03

Another option for a VPN connection is OpenVPN. This can be configured to use certificates (including self-signed, so it won't cost you anything) and it can be automated (i.e. no specific user login is required). OpenVPN can use a variety of different protocols (very flexible) and can accommodate permanent connections as well as user connections.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.