Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I will explain everything that is happening. I work in a NGO, and we have our office inside a university here in Brazil. Until a couple of weeks ago, our internet infrastructure worked something like this:

  • The university receives the internet connection
  • Their servers communicates with our Windows Server, which controls AD, DHCP and User Auth
  • The answer goes back to the their infrastructure and authenticate the computers connected to computers inside our office connected to their cables/wi-fi

Last week our server went down, and the company that provides us the support is very slow. So I tried to find different options of what to do, and could be easier to maintain, and cheaper than the support we have. What I thought was to use and Amazon EC2 Windows Server to be in place of our old server, therefore the university communicate with EC2, then authenticate the connected computers.

From a research we've made here, this should be possible, as long that the university connection to the EC2 is made on a VPN. My questions are:

  • Is this really possible?
  • The EC2 AD, DHCP and User Auth configuration would be the same as the local server we had?
  • The guys from the university are asking us how things would change for them. Would it just be that now they should use a VPN connection to an outside server, and not a local server inside their network? Or other changes would imply?

Thank you all in advance for the help :) Ps.: let me know if something is not clear!

share|improve this question
up vote 0 down vote accepted

In theory yes you could do this. As has been discussed on ServerFault before this doesn't mean you should.

The first issue you are bound to run into will be around latency. The last time I checked there isn't an Amazon Data Center anywhere near Brazil so you are looking at delayed logon requests and responses as you pray that the VPN tunnel stays up and then deal with the overall latent connection. Typically any sort of remote AD setup often results in long logon delays and overal user unhappiness as there is a noticeable period of time from hitting enter to the desktop popping up.

If the problem revolves around a support company who provides the server either find a new vendor or run the server yourself. As a full blown solution you could spin up the master AD box with Amazon for resiliency reasons and then have the university run a Read-Only DC on their network to make all of their requests against. This secures the data on the server and somewhat eliminates the VPN load back to Amazon.

Overall though I would recommend running the DC boxes locally whenever possible for the best performance. Users will thank you for it.

share|improve this answer
I understand your concern about latency, but AWS already have servers in Sao Paulo ( How long the would the delay be, any idea? Thanks for the suggestions and concerns! – guiligan Sep 4 '12 at 18:14
Cool, guess they have expanded more. A normal login for a client on the local network that the DC is on is typically not more than 1-3 seconds. Over a VPN I have seen that drawn out to 10 seconds. Like I said, if you have a local box or RODC that the university has direct access to and then a remote box where you can safely administer user records thats not a bad deal. – Brent Pabst Sep 4 '12 at 18:17

Would this work? Sure.

But I think you're just trading one set of problems for another. If you don't have the resources to manage a local server yourself, do you really have the resources to manage an Amazon EC2 instance?

share|improve this answer
Hey @longneck, thanks for the response. Actually, the biggest deal right now is that they don't give us any access to the server (even being inside our office), because that violates one of the agreements people made here in the past. So either I could move to EC2 (removing the pain of having the server here, and hardware maintenance), or void the contract (buying the spare parts that we need and continue the administration by our own anyway). – guiligan Sep 4 '12 at 18:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.