I have a very small, but distributed network. In the central office, there's a Windows Server 2008 R2 VM with a few Linux VMs running on the same box. There are two client PCs running Windows7. In a remote location, there is a single client PC, currently connecting into the central office with OpenVPN via one of the Linux servers.
I would like to move from Workgroup to Administrative Domain for better group policy control. I will not be able to justify additional server hardware or Microsoft licenses (those things are ridiculous) but can easily add more VMs to the existing server.
The way I see it I have a few decisions to make, each with a few options.
Which server runs the domain
- Windows Server 2008
- Traditional AD solution
- Can't add a backup controller without another license
- Windows server is also running FTP and AS functions; AD servers typically just host AD.
- One of the Linux boxes with Samba)
- Not the traditional AD solution (am I giving up any features?)
- Can easily (read: cheaply) add a backup controller
- If necessary (not ideal), can add a DC at remote location
How do I authenticate / authorize the remote locations
- Add remote Linux DC at remote location (seems like overkill for one remote client)
- Somehow connect to the VPN prior to logging in to Windows (is this even possible?)
- Expose my AD to the internet without VPN. (seems like a terrible idea)
Are there any options I'm missing? This has to be a pretty common situation for small businesses, I can't imagine these IT-less companies are buying multiple WinServer boxes to setup the traditional solution of a standalone AD, a standalone backup AD, and then another box to host everything else....
I'm a Linux guy and have no problem getting my hands dirty, but don't have a wealth of IT experience.