0

Can a Windows Server be connected to an Active Directory domain without being a domain controller? Here's the scenario:

I want to use Windows Server 2012 to run several virtual machines for testing our web application in a variety of environments. We have a corporate domain, and I'd like to use the corporate login (or at least a common login) on each of the virtual machines without necessarily having to get IT to set up each virtual machine on the corporate domain. Also, I need the server itself to be able to authenticate domain logins (the app uses domain login information for users to login). However, I absolutely do NOT want it to be a DC on the corporate network.

Thus, my questions:

  • Can a Windows Server be connected to an Active Directory domain without being a DC?
  • Can a Windows Server authenticate users on another domain without being a part of that domain?
  • Can a Windows Server be a domain controller in a small network (comprised of just the server and itself) and use the corporate domain's Active Directory for authenticating user logins to the server, the web app, and the virtual machines?
4
  • Define "micro-domain".
    – joeqwerty
    Sep 18, 2012 at 19:58
  • This is really, really unclear. Instead of asking for off-the-wall ways to work around some undefined problem, why not thoroughly explain the actual problem that you're facing and clearly define your limitations.
    – MDMarra
    Sep 18, 2012 at 20:00
  • @MDMarra I thought I had explained what I was looking for before asking the questions (second paragraph above). I want a Windows Server that can authenticate user logins to the virtual machines running on it against the Active Directory of the corporate network without the server being a DC.
    – saluce
    Sep 18, 2012 at 20:06
  • 2
    Then the answer is no. You can't do that.
    – MDMarra
    Sep 18, 2012 at 20:10

4 Answers 4

3

So, just to be clear, is this an accurate description of your problem?

  • You have an app that you want to test in a couple of virtual machines.
  • This app supports Active Directory integrated authentication.
  • You want to have a domain somewhere that you can use to test that authentication mechanism.

If this is true, then you definitely DO NOT want any of those machines to be a member of your corporate domain.

You should instead have a separate test domain for testing your application. This domain can be hosted on a virtual machine (domain controller).

You can set up this domain to trust your real, corporate domain. Then add realCorporateDomain\Users to the testDomain\Users group. This will allow you to log in to the computers in your test domain.

2
  • You are pretty close in your description. It's less about testing the authentication and more about using the same login on each of 4-5 different test VMs, preferably using the corporate AD domain. You are talking about setting up a one-way trust, right?
    – saluce
    Sep 18, 2012 at 20:15
  • Yes, a one-way trust.
    – longneck
    Sep 18, 2012 at 20:30
4

Update: Based on your most recent comment, the answer is no.

In situations like this, administrators typically give developers a test domain that is separate from the corporate network. They (usually) have much more access to the test domain so that they can document and test their application before deploying it in production.


Can a Windows Server be connected to an NT domain without being a DC?

For the sake of this question, I assume you're using Active Directory and NT Domain interchangeably. All following answers assume an AD domain with (at least) Windows 2003 Domain Controllers.

Yes. This is called a member server. You will never see an organization where every server is a DC unless it's a small 1-2 server shop.

Can a Windows Server authenticate users on another domain without being a part of that domain?

You can set something up like AD LDS, which gives you an LDAP front-end without being a domain controller.

Can a Windows Server act as a domain controller for a "micro-domain" and use the corporate domain's Active Directory for authentication?

Yes. It sounds like you definitely want to join the server to your corporate domain (with the permission of your administrators) and look at installing and configuring AD LDS.

4
  • So, if I understand correctly, the virtual machines can look to my server for logging in users without the need for the server itself to be a DC, simply a member of the domain?
    – saluce
    Sep 18, 2012 at 19:57
  • 1
    You need to read about AD LDS and what it does. It can be used as an authentication source for applications. Not for standard AD logins. It only takes about 5 minutes to head over to technet and read the basics. Then you'll have an idea about whether or not it's the right technology to solve your problem. If you want whole machines to authenticate against your server, you'll need to make it a Domain Controller. Generally, test domains are set up for this sort of thing.
    – MDMarra
    Sep 18, 2012 at 19:58
  • Regarding your update, that is almost exactly what I want. The only thing more is being able to have the test domain authenticate users against the corporate domain AD.
    – saluce
    Sep 18, 2012 at 20:19
  • You can use various tools to clone accounts from production to test environments. Ldifde, ADMT, etc.
    – MDMarra
    Sep 18, 2012 at 21:06
0

Can a Windows Server be connected to an NT domain without being a DC?

Yes.

Can a Windows Server authenticate users on another domain without being a part of that domain?

That depends. Access to SMB shares for instance will work without prompting if the username and password are identical on both sides.

Can a Windows Server act as a domain controller for a "micro-domain" and use the corporate domain's Active Directory for authentication?

Above you said that you have an NT domain. NT domains don't run Active Directory, and modern Windows servers cannot be DCs in NT domains.

1
  • Sorry, I meant Active Directory.
    – saluce
    Sep 18, 2012 at 19:55
0

If by "NT domain" you mean a domain managed by an actual Windows NT 4.0 PDC, then no, you can't join recent Microsoft operating systems to NT domains any longer: http://technet.microsoft.com/it-it/library/ee681706(v=ws.10).aspx.

If instead you mean an Active Directory domain, then please call it so :-) And, yes, you can safely join a Windows Server 2012 machine to any AD domain, without any need for it to be a domain controller.

If you instead want your server to be a domain controller (for its own "micro-domain"), then you can't join it to any other domain, as by definition a computer can only be member of a single domain, and a DC needs to be a member of the domain it manages.

1
  • Apologies, I meant (and have edited to state) an Active Directory domain =)
    – saluce
    Sep 18, 2012 at 19:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .