Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm in the process of learning Windows Server 2012, so I just did a fresh reinstall of it. Before I actually setup a local domain, I'm wondering how to access this from outside of my network. My setup is as follows:

  1. Windows Server 2012 Computer, IP, Primary DNS
  2. Laptop, IP, Primary DNS, Secondary DNS (Google)

I read an article stating that for internal networks you should setup your domain as mydomain.local instead of something that might not resolve properly (i.e. But, if I use the local version, when I take my laptop outside of the network, how can I get access back into my network for file shares and user profiles and etc?

Please go easy on me as I am still learning. :)

share|improve this question
Don't use .local. Ever. – MDMarra Jan 13 '13 at 4:10
@MDMarra: Good to know for someone that is just starting out. That's why I always prefer stack sites for knowledge versus any other website out there. – m-y Jan 13 '13 at 4:22
What's so wrong with the question that it deserves a downvote? – m-y Jan 13 '13 at 22:38
up vote 2 down vote accepted

It's for this reason that best-practices recommend basing your AD domain in a DNS domain you actually officially control. Instead of something.local, use This way you'll have reliable DNS resolution wherever you are.

Now, being able to access AD services across the Internet is something else entirely and it is a not wise thing to expose those ports to anyone and everyone. This is why most organizations use some kind of VPN to allow access to internal AD resources.

This can be an issue for mobile assets that roam about, such as the laptop the Sales people carry with them as they fly across a nation. Happily, Windows will cache credentials for a certain period, and getting the laptops talking to the domain controllers once in a while (that VPN connection again) will keep them refreshed with policy and creds.

share|improve this answer
Who is this "best-practices" person who made that recommendation? – John Gardeniers Jan 13 '13 at 5:27
@JohnGardeniers The Great Microsoft itself: – Blue Warrior NFB Jan 13 '13 at 13:31
@john take a look at the link I posted on the question itself. There are a lot of reasons to avoid .local if "because it violates the RFCs" isn't enough. – MDMarra Jan 13 '13 at 23:19
@MDMarra, I'm not advocating the use of .local but I also don't advocate using a public domain internally. In most cases it causes far more problems than it solves. – John Gardeniers Jan 13 '13 at 23:25
How? Using split horizon is definitely bad, but there are really no issues at all using a non-public subdomain of a namespace that you use publicly. Assuming you use a DNS delegation and have sane firewall rules, what problems could this possibly cause? – MDMarra Jan 13 '13 at 23:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.