Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I work for a company that has roughly 500 (expanding to over 1000 this year) computers out in the field. These computers are spread all through America, with 2 of them in Canada (noone bothers with those).

All of these computers have LogMeIn installed on them, and they've (until now) been managed via LogMeIn.

My company has a really bad case of "cloud-itis" wanting to put virtually everything into the cloud, even when it has no reason to be in the cloud. So my questions are as follows here:

  1. Is there any way I can effectively manage / scale a large number of PC's running windows 7 without setting up a domain forest / remotely joining all of them (I'm not even sure that would be possible because the moment I joined to the VPN it would disconnect me...) all to the domain. Right now there is no group policy, no user tracking, no usage tracking, and now uptime reporting. All of these things present huge hurdles for my style of administration.

  2. If I were to set up a domain forest, what would the best way to do that "in the cloud" be? Right now we run everything off Amazon EC2 instances, however wouldn't the secondary nameserver have to self reference since it was an online resource? I'm a little confused about how to set this up compared to a traditional domain cluster.

Fun facts:

  • The computers aren't on our networks, all of them are on customer networks
  • I have none of the public IP's available so I'd have to run my domain controller in promiscuous mode.
share|improve this question

migrated from Apr 29 '13 at 18:55

This question came from our site for computer enthusiasts and power users.

looking at point no.3, how much you are paid (per hour)? – user170531 Apr 29 '13 at 13:00
by the way, could you just forget about the workstation and only manage the cloud instead? idea: the company subsidize it's employee to buy their own machine, for which it is not related to the company. The idea: UYOD <<-- use your own device... – user170531 Apr 29 '13 at 13:03
lol at "2 of them are in Canada (no one messes with those)" – Ryan Ries Apr 29 '13 at 19:10
Logmein does have reporting and some group policy support. – Greg Askew Apr 29 '13 at 20:39
up vote 4 down vote accepted
  1. Windows Intune

  2. I have no idea what you're asking here. You set it up in the cloud like you would locally. You install the AD binaries, promote the servers to Domain Controllers, and join things to the domain. Instead of having them publicly accessible, put them behind a firewall and set up persistent VPNs from client workstations, laptops, and servers to the cloud-based Domain Controllers.

It's important to note that I've dealt with dozens of AD deployments from small K-8 schools to large multi-site national installs with a dozen child domains. I've never seen a case where putting your entire AD infrastructure in the cloud is a good choice. Consider hiring an experienced consultant that has a lot of experience with AD to evaluate your needs and see if this actually makes sense for your needs. I doubt it will.

share|improve this answer
What I picture in my head is that he's either at a service company, providing desktop support to other companies, or he is supporting his companies' users, who are distributed among client companies. But yea, I don't completely get it either. – gWaldo Apr 29 '13 at 22:29

Honestly, It sounds like you have a problem of company / position fit. It may be worthwhile to speak with someone in your supervisory chain about the mismatch in expectations between you and they of what your role would be, and how that would (or could) be done effectively.

If nothing else, take the lessons from your experience in 'Interview vs Real Life' and add them to your list of questions for interviews at future gigs. After one such life experience, I try to get as much insight into what the day-to-day operations and infrastructure is like. If the interview is going well, I ask to tour the Datacenter / Server room, I want to see the computers and office equipment that they are using, etc.

share|improve this answer

So the answer to question #1 is "Nope" -- There is no way to effectively manage machines scattered all over the world without a VPN or something similar putting them all on the same virtual network.
You MIGHT be able to come up with something acceptable using Deep Freeze or similar "always force the system to a consistent state on reboot" tools, but that's definitely sub-optimal (especially if we're not talking about gigabit connectivity between the systems and your distribution server).

The answer to question #2 is "Some things do not go in the cloud. This is one of them."
The idiotic fallacy by management that all things can be made better by putting them "In The Cloud" should be nipped in the bud - putting your AD domain "in the cloud" without extensive planning and network (VPN) design is a recipe for security disasters.

Frankly without knowing more about what you're trying to do/support we can't offer you much advice, but a Windows/AD domain is the Wrong Solution for what you're describing -- and it sounds like your company is operating in clueless panic mode rather than architecting solutions.
There's not much we can do to help you out with the fact that there's no real solution for the architecture you're putting forth, but you may want to spend some time on our Workplace related site to help you figure out how to talk to management and create reasonable expectations.

If you can come up with a better explanation of what you're actually trying to accomplish we might be able to offer better guidance...

share|improve this answer
Actually, re: 1. this is exactly why Microsoft introduced Windows Intune. You just have the Intune client installed and bam you can manage it from Azure with a sweet no-hassle interface. It's sort of like SCCM's slightly less useful bastard cloud-based spawn. – MDMarra Apr 29 '13 at 19:18
@MDMarra It sounds like he's looking for full domain functionality at each of the clients (unless I'm misinterpreting the question?) -- Does Intune give domain logons, etc.? – voretaq7 Apr 29 '13 at 20:24
It doesn't allow/mimic domain logons, but lets you do software deployment, update management, asset tracking, etc. It can be used standalone (which integrates with a cloud instance of Azure AD) or it can be combined with an on-premise AD using DirSync. The "allure" of Intune us that you don't need a domain to get client config management or MDM. The product is still in its infancy and has some warts (and I also wouldn't recommend it for a 1k user organization) but it can potentially fill the OP's needs. – MDMarra Apr 29 '13 at 20:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.