Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My organization is in the process of setting up a new network at a hosting provider for a very large application project. Since the whole system uses Active Directory we are planning on using a pair of Domain Controllers there that replicate to our headquarters over VPN. These DCs would also serve as backup for our existing system so we could lose connection or power entirely at our headquarters and the remote system could stay up and still let people log in.

Our hosting provider has setup as our subnet to use with them. But because our internal IPs are and they already have it in use they require us to NAT over to This part wasn’t a big issue and easily setup with our Watchguard firewall appliance.

First sign of trouble was when I put the two servers on the domain and they couldn’t connect or find the domain at all. I ended up putting a post-NAT address of DOMAIN.LAN into the hosts file on both servers. They were then able to locate and join the domain.

Making them Domain controllers however has been a problem. They get all the way through setup and then fail with an error when they try to setup all the replication with “RPC server is not available”. I know the domain is prepped correctly, Last week I did all prep work to promote a new server to DC to replace an older machine which went through fine.

I suspect the NAT is the issue and servers are trying to set themselves up with pre-NAT addresses. Our provider wants us to remap our IP scheme to fit with their network and I'm not exactly thrilled with the idea. One option we are considering is creating a server and network on and using intersite replication to go from to to (although that is probably gonna be messy network config-wise to figure out.) But I’m not completely convinced if that would solve the issue. A DMZ is another option but need to look into it more before I try to get our provider to set that up.

Has anybody had experience with a similar setup or alternatives for getting DC setup on a remote connection?

share|improve this question
I wonder whether the right architecture in thie scenario might be to use Federation services instead of remote DCs. Not sure Domain controllers will have much luch replicating over a NAT'd connection – uSlackr Mar 13 '12 at 22:39
Yes I agree with the above commenter. Please don't do this. – Ryan Ries Mar 13 '12 at 22:47
We already run FS but it is out of our headquarters, which unfortunately means if our main site goes down for whatever reason we lose FS. – Shial Mar 14 '12 at 12:45
up vote 10 down vote accepted

You don't want to do this through NAT. You could construct a nightmarish scenario where you manage the DNS records for the DCs and hand-register the NAT "outside" addresses in the DNS. With the right port-forwards through the NAT you could probably make it all work.

You would be best served with a site-to-site VPN to allow the DCs to have transparent communication and to allow them to register their NIC-assigned addresses in DNS. IPSEC on public IP addresses is a possibility, too.

Beyond the network communication issues, though, I think you have a security architecture concern.

I would argue that you need two AD forests. Your "back office" AD forest should really be separate from the AD forest that runs your application. You can certainly have a replica DC from the application forest within your physical headquarters location, but I'd strongly caution against a two-way trust between the forests. I certainly wouldn't want both domains to be part of the same AD forest.

share|improve this answer
This is on a site to site VPN so I'm having serious doubts about how the hosting provider setup this connection on their end. – Shial Mar 14 '12 at 12:49

I got it to work due to the time crunch but it is a complete hack and I am working on rebuilding the whole network in the next few months to eliminate the need for it. As it turns out the domain lookup is via the server IP but replication is by looking up the GUID. Running repadmin /fix /s:DC1 gives you a report where you can see the GUID it is attempting to connect to, this is also found in DNS under Forward Lookup Zones, domain.loc, _msdcs.

I added to the Hosts file (c:\windows\system32\drivers\etc\hosts) on the new DCs both the post-NAT address of the server and the GUID and I was able to get them to replicate successfully. This is what I had to add in to make it work for each DC that was on the other side of the NAT:   DC1.domain.loc   b48aa2d2-5b6a-8723-ab6c-239b8a76c782323a._msdcs.domain.loc

I REALLY do not suggest anybody else try and do this in a production system for anything long term. I'm documenting it and working on reengineering the network as part of our overall plan to get rid of this.

share|improve this answer

This might not be a complete answer, but it seems that according to MSFT, there is a Registry setting that allows a computer to register alternative IPs in DNS.

Registry Value: PublishAddresses    
Registry Value Type: REG_MULTI_SZ    
Registry Value Data:<IP addresses>

Apparently if you set this with the NATed IP for the server, then the machines on the other side should be able to communicate to it.

The linked article is specifically talking about using this for setting up AD in a NATed environment.

share|improve this answer
the article referenced actually spells out "The Microsoft guidance on hosting domain controllers separated by a NATted network is summed up by the article “Active Directory functionality is not supported over a router that has Network Address Translation (NAT) enabled”. This does some good general guidance on what network connectivity is required for things to work well." – Jim B Feb 23 at 15:37
@JimB - but that's the scenario they're actually doing, right? i.e they have a DC in 172.x and 192.x and the 192.x IP is natted. – Will Hughes Feb 25 at 1:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.