Do you prefer to run their IIS webservers inside a DMZ that is part of the greater organisation's AD or do you prefer to sacrifice ease of management and user control over (possibly perceived) security?
We currently run our IIS boxes outside of the domain and this enables us to keep a one-way rule with our firewall (no traffic from DMZ to LAN except 1 SQL port). However, this means I now have to use non-AD authentication and manually synchronize passwords across boxes.
Which is more secure?
found an answer here http://serverfault.com/questions/13014/active-directory-in-a-dmz