Remotely administer hundreds of computers

Question

I work for a company that has roughly 500 (expanding to over 1000 this year) computers out in the field. These computers are spread all through America, with 2 of them in Canada (noone bothers with those).

All of these computers have LogMeIn installed on them, and they've (until now) been managed via LogMeIn.

My company has a really bad case of "cloud-itis" wanting to put virtually everything into the cloud, even when it has no reason to be in the cloud. So my questions are as follows here:

1. Is there any way I can effectively manage / scale a large number of PC's running windows 7 without setting up a domain forest / remotely joining all of them (I'm not even sure that would be possible because the moment I joined to the VPN it would disconnect me...) all to the domain. Right now there is no group policy, no user tracking, no usage tracking, and now uptime reporting. All of these things present huge hurdles for my style of administration.

2. If I were to set up a domain forest, what would the best way to do that "in the cloud" be? Right now we run everything off Amazon EC2 instances, however wouldn't the secondary nameserver have to self reference since it was an online resource? I'm a little confused about how to set this up compared to a traditional domain cluster.

Fun facts:

• The computers aren't on our networks, all of them are on customer networks
• I have none of the public IP's available so I'd have to run my domain controller in promiscuous mode.

Answer 1

1. Windows Intune

2. I have no idea what you're asking here. You set it up in the cloud like you would locally. You install the AD binaries, promote the servers to Domain Controllers, and join things to the domain. Instead of having them publicly accessible, put them behind a firewall and set up persistent VPNs from client workstations, laptops, and servers to the cloud-based Domain Controllers.

It's important to note that I've dealt with dozens of AD deployments from small K-8 schools to large multi-site national installs with a dozen child domains. I've never seen a case where putting your entire AD infrastructure in the cloud is a good choice. Consider hiring an experienced consultant that has a lot of experience with AD to evaluate your needs and see if this actually makes sense for your needs. I doubt it will.

Answer 2

Honestly, It sounds like you have a problem of company / position fit. It may be worthwhile to speak with someone in your supervisory chain about the mismatch in expectations between you and they of what your role would be, and how that would (or could) be done effectively.

If nothing else, take the lessons from your experience in 'Interview vs Real Life' and add them to your list of questions for interviews at future gigs. After one such life experience, I try to get as much insight into what the day-to-day operations and infrastructure is like. If the interview is going well, I ask to tour the Datacenter / Server room, I want to see the computers and office equipment that they are using, etc.

Answer 3

So the answer to question #1 is "Nope" -- There is no way to effectively manage machines scattered all over the world without a VPN or something similar putting them all on the same virtual network.
You MIGHT be able to come up with something acceptable using Deep Freeze or similar "always force the system to a consistent state on reboot" tools, but that's definitely sub-optimal (especially if we're not talking about gigabit connectivity between the systems and your distribution server).

The answer to question #2 is "Some things do not go in the cloud. This is one of them."
The idiotic fallacy by management that all things can be made better by putting them "In The Cloud" should be nipped in the bud - putting your AD domain "in the cloud" without extensive planning and network (VPN) design is a recipe for security disasters.

---

Frankly without knowing more about what you're trying to do/support we can't offer you much advice, but a Windows/AD domain is the Wrong Solution for what you're describing -- and it sounds like your company is operating in clueless panic mode rather than architecting solutions.
There's not much we can do to help you out with the fact that there's no real solution for the architecture you're putting forth, but you may want to spend some time on our Workplace related site to help you figure out how to talk to management and create reasonable expectations.

If you can come up with a better explanation of what you're actually trying to accomplish we might be able to offer better guidance...