Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Do you prefer to run their IIS webservers inside a DMZ that is part of the greater organisation's AD or do you prefer to sacrifice ease of management and user control over (possibly perceived) security?

We currently run our IIS boxes outside of the domain and this enables us to keep a one-way rule with our firewall (no traffic from DMZ to LAN except 1 SQL port). However, this means I now have to use non-AD authentication and manually synchronize passwords across boxes.

Which is more secure?

found an answer here http://serverfault.com/questions/13014/active-directory-in-a-dmz

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

you can get the best of both worlds. AD LDS can be implemented and federated with your domain see this article for an overview

share|improve this answer
    
We've created our own, full blown AD inside our DMZ - no trust with our main AD. Helps with the server organization tremendously - think Group Policy for security, integrated WSUS etc. Although it certainly causes issues with DMZ to LAN SQL authentication :-) –  Christopher_G_Lewis Jul 8 '09 at 18:28
1  
You can certainly do that, you can fix the the authentication issues by federating the AD's. Federation is not a trust. Here's more detail that you wanted about how it works: msdn.microsoft.com/en-us/library/bb498017.aspx –  Jim B Jul 8 '09 at 19:17
add comment

We run our IIS servers in a domain -- their own domain. When app pool identity and services run in a domain account, it is much easier to control access to shared files, data and other resources on different machines. Their are security, scalability, and ease of use benefits to this model. I can't think of any risk to putting the IIS server in a domain, that is difficult to manage.

share|improve this answer
add comment

We have off-the-shelf product that requires us to run the software on an domained IIS server. What's more, at least one of the OTS packages we have is designed to be internet-facing and required to be domained. Some might call this a poorly designed application, but we have to use it so the question is a tad moot.

share|improve this answer
    
What product requires a domained IIS server? –  Jim B Jul 8 '09 at 4:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.