Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have sent the following question to stackoverflow website

I have installed Windows server 2008 r2 on a virtual machine, Can I install Active directory with domain controller + IIS + SQL server on the same machine? I want to make web application and this web application will authenticate users from Active Directory, the web application should be published on the server IIS and the users should access it remotely from their home using domain name of my machine, Someone tell me that its very wrong to have IIS and Active directory on the same machine

I got the following Answer

You can't use ActiveDirectory over the internet. At least not without something like a VPN as a middle man. Their home computers will not be joined to the domain, so there is no pass-through authentication.

Yes, it's a bad idea to put AD on the web server. Why is too complex to get into in an answer here. Suffice it to say that even if you did do this, it's probably would not work the way you are thinking it should.

It's not impossible to do this. For instance, many of the Microsoft "Small Businesss" products put IIS, AD, and SQL Server on the same server. But, you kind of have to know what you're doing to configure it securely.

Then I add the following comment

Thanks for ur what you think about the best way to do this as I didn't do anything like that before should I install active directory on a machine and IIS on another machine ? and what about SQL should I add it to the same server of active directory ? I didn't mentioned also that it will be Microsoft dynamics server that will access some information about work and i have to read data from axapta also ? also what is VPN and how can I use it to let users access my web application anywhere ? Sorry for my long questions and thanks in advance

so please if anyone can help I will be thankful

share|improve this question

The person misunderstood your question. You can certainly use Active Directory to authenticate public internet users to a web site. You cannot use the automated Windows Authentication, where Active Directory automatically authenticates you based on the user account on your local computer, but you can provide a username and password box on your site that will check the entered values against an Active Directory domain and look for things like correct group membership.

It's not a good idea to have an organization's Active Directory domain on a public web server. This is true not only for security reasons, but also as a protection against denial of service assaults, where an assault on the web server could prevent user from working on their local machines because AD is also unavailable. But there's no technical reason it wouldn't work. If authenticating your web users is the only purpose of this Active Directory domain, you can certainly do this without fear. However, if that really is the only purpose, you're better off using something like AD LDS (Lightweight Directory Services: think Active Directory Lite).

Sql Server is a similar story to Active Directory. It's not always a good idea, but it can technically work. You can at least start out like this, and later on move the Sql Server to a different host if the need arises.

share|improve this answer
I'm sorry that I borrow the question a little. So it is no problem to run Active Directory on the same machine as IIS, and then use Active Directory as a user database so users can log on to the website Im drifting on IIS? – Johan Nordli Jun 3 '14 at 11:40
There is no technical problem. There are security concerns doing this, if AD is also handling your internal accounts and directory. Also, it's just as easy to have AD on a separate server from IIS, and still authenticate your web users. – Joel Coel Jun 3 '14 at 13:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.