Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I set up a 2008R2 AD in a small office (less than 10 users). We are opening a delegation, and I'm studying the different choices for the domain (let's say domain.com). The link between the offices will be a WAN accelerator with an IPSec tunnel, as both of them are connected to Internet through ADSL connection (around 6Mbps/600Kbps). File server and ERP application will remain in the main office.

I've been searching for a comparison chart or a cons-pros list, but I haven't found anything.

First choice, secondary domain. AFAIK, it would imply the creation of a subdomain (branch1.domain.com). Would it also imply that users are different or anyone could log in any of the domains? I guess DNS management would be independent between zones. Any other consideration?

A domain replica is another option, but I'm not very expert, and I fear DNS management of the different offices. On pros, I guess it would speed up login and would make my domain high-availability. But another office will probably be opened, any problem with 3 replicas? I read that replication is made in a ring manner, but links are only point to point with main office, I don't need offices to be seen between them. Would this be a problem?

The third option, a Read Only Domain Controller seems to be the best, as it would have the good thing about replication with no (or less) considerations. It will also have the bad thing about DNS management.

If someone could lighten this up, or point me to a tutorial or something where this things are explained, I would be grateful. I've been reading about the three options, but can't find any comparison between them.

share|improve this question
    
What do you mean by "opening a delegation"? Are the users in this second office part of the same company as your first office? Would simply creating a new Active Directory site meet your needs? –  Ben Pilbrow Dec 17 '11 at 16:40
    
Yes, it is the same company, and some users will travel from one to another, so a new Active Directory wouldn't be the best way. –  Mike B Dec 17 '11 at 16:42
1  
No, a new Active Directory site is very different than a whole new Active Directory. It's exactly as it sounds - your AD domain, but in a different site. A new site in AD sounds exactly like what you want. –  Ben Pilbrow Dec 17 '11 at 16:45
add comment

1 Answer

up vote 4 down vote accepted

It sounds like you simply want a new Active Directory Site defining. Pardon me from quoting the documentation, but this describes your situation perfectly in my eyes.

In Active Directory, a site is a set of computers well-connected by a high-speed network, such as a local area network (LAN). All computers within the same site typically reside in the same building, or on the same campus network. A single site consists of one or more Internet Protocol (IP) subnets.

You would put your second office in a second subnet and define this in Active Directory. Clients in each site will prefer local Domain Controllers for speed reasons, but will go across the WAN if either the in-site Domain Controller is unavailable or it explicitly requires to speak to a Domain Controller in another site.

share|improve this answer
    
Your comment lead me to that link. It also seems to me a good option. All users would be managed together, and login would be made fast against the local DC –  Mike B Dec 17 '11 at 16:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.