Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a remote web server (Windows 2008 Web Edition) to host some applications and company website.

We only access this server using RDP. But I'd like to access it as it was in our LAN, so I'm considering adding it to my local Windows 2008 domain using a permanent VPN.

Is it a good idea?

My concern is that this server can't be affected by eventual domain problems.


share|improve this question
up vote 3 down vote accepted

I personally wouldn't do this. My primary concern would be having a public facing machine connected to a private network like this. For example, if someone installed a keylogger through an IIS vulnerability, they would also have access to a domain account (if you logged in with your domain credentials).

share|improve this answer
Good point, thanks. – Erick Sasse Jul 22 '09 at 1:42

You can have a site-to-site VPN without it needing to be on your domain. Treat the server like a DMZ - a lot of large companies have a way into it, with only the necessary services allowed through it, but also have a DC setup in the DMZ for manageability.

As you only have one server, local accounts with strong passwords are probably lower maintenance.

share|improve this answer

Whether or not the computer is a member of the Active Directory domain has little to do with how you access it.

If the proposed VPN connection allows for arbitrary traffic from the web server into the protected network I'd be frightened. If the VPN solution lets you specify traffic filters and statefully allows connections from inside the LAN to access the web server ("Don't speak unless spoken to...") it's less frightening but still vastly less compartmentalized than leaving the web server isolated.

If the convenience really justifies the risk then go for it. My guess is that you can find convenient ways to interact with the web server that don't involve giving it any type of direct communication path into the LAN, though... (WebDAV over SSL for file management, SFTP, etc).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.