How to correctly setup a multi sites active directory?

Question

In the future my company will have 3 main office. This is my first time i've to manage 'branch offices'. Main site will manage 30 devices (user + device) , secondary branch at maximum 10-15 devices per branch.

All branches will be connected through 8-10 mbit symmetric HDSL lines.

We will have the main office with 1 windows server (2008) with active directory. The others 2 offices will have their server.

So my question is: how will be managed active directory ? We have to configure active directory eithers to the branch offices ? Or maybe we will have to simply 'replicate' main active directory ?

Can you point me some usefuls link that explains how to manage multi sites active directory ?

Answer 1

You have a couple of options.

1. You can set up child domains at each remote office and have a forest root at your HQ.

2. You can have a single AD domain that spans multiple sites with domain controllers at each site, which is configured using the Active Directory Sites and Services snap-in.

#2 is recommended by Microsoft now-a-days and you really don't need child domains unless you have an explicit reason to. They are management boundaries, but most management can be delegated easily using the ADUC Delegate Control wizard in modern versions of AD.

I recommend at least 2 DCs at each site for resiliency with either plan, but if push comes to shove, you can get by with 1 at each remote site and at least 2 at the main site.

Answer 2

Have a look here: Active Directory Best practices

The recommendation is:

Establish as a site every geographic area that requires fast access to the latest directory information. Establishing areas that require immediate access to up-to-date Active Directory information as separate sites will provide the resources required to meet your needs.

Place at least one domain controller in every site, and make at least one domain controller in each site a global catalog. Sites that do not have their own domain controllers and at least one global catalog are dependent on other sites for directory information and are less efficient.