Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a bunch of servers up on the Amazon EC2 cloud running Windows 2003 Server, and I was wondering if you knew of any ways (apart from a domain controller, which sounds like a pain to do on EC2) to administer users for all of the instances.

The use case here would be a terminated employee - I would love not to have to login and remove privileges for each running instance. I believe that installing AD, and running an instance as a domain controller will do the trick, but are there other ways?

Also, if you have experience on running a domain controller on the cloud, I'd love to hear from you as well!

Thank you everyone in advance! Lucas Ostrowski

share|improve this question

migrated from stackoverflow.com Jan 24 '11 at 19:52

This question came from our site for professional and enthusiast programmers.

add comment

2 Answers

If you want centralised account management in Windows then you are talking active directory, so you would need a domain controller.

You can, of course, write a few scripts yourself that can allow you to run them from a central point and allow them to remotely access and manage local accounts on each machine but you will need to deal with the fragility, accepted that a malicious employee may be able to get around these scripts and that there will be little real feedback from the account management scripts... but I suspect that by the time you've done this, you might as well have preferred the domain controller option.

share|improve this answer
    
Gotcha, yea it seems that the AD/domain controller option is our best bet. Fun times ahead! Thanks for your input! –  Lucas Ostrowski Jan 26 '11 at 19:54
add comment

Only thing I can think of is LDAP.

But we have one client with AD controller in EC2 and it works w/o any problems. Just allow all ports at this instance for all your other instances.

share|improve this answer
    
Did you have to make any DNS changes for this? I read this blog post: blog.joefield.co.uk/?p=25 and was a little confused.. Thanks for your help! –  Lucas Ostrowski Jan 26 '11 at 19:56
    
Personally I didn't install it, but I don't see any specific configuration except opening all ports at AD for all your instances. As far as I know windows uses broadcast to find DC. Anyway you can launch 2 test instances and try it by yourself :) –  Denis Kot Jan 27 '11 at 12:14
    
Windows uses DNS to locate a DC, not broadcast. Once the DC is built, the other servers need to point to its IP address for their DNS servers. In this way, using AD in the cloud is the same as AD anywhere else. –  icky3000 May 1 '11 at 1:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.