Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We used to have a domain controller in our local office network. Now we have moved the servers to data center and the dc is there, behind the forefront TMG firewall.

In order for my office computers to be able to authenticate to the domain, I have the following options that I know of:

  1. I can VPN into a data center servers network (vpn gateway is set up inForefront TMG) and authenticate as if I am in the local network with the domain. Ho can I setup VPN clients in Windows 7 to connect via vpn automatically at login?

  2. I can publish the DC's Active Directory integrated DNS server via Forefront Publishing rule. Set up my local network to use this DNS, so that the DC can be found. And allow LDAP traffic through Firewall.

Which one of these approaches is better?

share|improve this question
up vote 5 down vote accepted

The VPN option is better, since you won't be exposing LDAP to the outside world unnecessarily.

Side note, I'd want at least one domain controller at my local site. If your link to the data center goes down, you're screwed.

share|improve this answer
I second MDMarra security point. I just want to add that this DC needs to stay in sync with the other DCs in the data center. So the local DC should have some way of reaching it. VPN on the local DC will do for that. Or you could have a routing rule somewhere that points all traffic to the servers in a data center to a single PC/firewall which VPNs into the datacenter. That would also solve the need for a local DC. (But not haveing a local DC is a bad idea performance wise and you will get into trouble if the external network goes down) – Hennes May 31 '12 at 11:27
If you concur with my answer an upvote would be nice :) I don't need the rep, but voting in general on SF is low compared to other sites in the network. It's good practice to upvote an answer that you agree with. – MDMarra May 31 '12 at 12:58
Had to uncheck as answer since it turns out that this may not be the option at all. Unless DirectAccess server is introduced in the domain network, I can't set up Windows 7 clients to automatically VPN into the DC network at logon. – Maxim V. Pavlov May 31 '12 at 13:58
@MaximV.Pavlov That would be a terrible way to do it anyway. You would set up a site-to-site VPN between the office and the datacenter, essentially converging the two networks into one over the WAN link. You shouldn't configure VPN access for every single client, just route the traffic that needs to get to the DC through the site-to-site tunnel. You don't need to use a Windows VPN solution for this if it doesn't fit your needs. There are plenty of other ones that handle site-to-site just fine. – MDMarra May 31 '12 at 14:27
Ok, you are right. Thank you. – Maxim V. Pavlov May 31 '12 at 14:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.