Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I work with a large Active Directory. We have domain controllers distributed across many sites. At my site we have been trying to create a private network which has access only to a very small list of servers in the larger network. This access is controlled via an access control list on the router. Everything works as we had planned except for Active Directory integration.

We had planned to have a number of Windows PCs inside this private network that would still participate in the active directory, but this is proving troublesome. We are able to make this configuration "work", but not in an acceptable way. Users are able to login using their domain accounts, but only after waiting about 20-40 minutes after entering their credentials.

It appears that the computers inside the private network are attempting to connect to each of the various corporate domain controllers, but due to the ACL they are only successful when they eventually stumble upon our local site DC. I am strongly resisting the temptation to fix this by adding every global DC into the ACL because the intention of the private network was to improve security.

Is there a way to make a configuration like this work? I think all that needs to happen is for the client to select a local DC, but I am not aware of a mechanism or setting that allows for this. I am not a domain admin, but they aren't offering any solutions currently.

Any ideas? Not having Active Directory integration in the private network is a big loss in terms of manageability.

EDIT: Regarding the idea of putting the private network ranges into Sites and Services... This was the direction I expected possible responses to go, and I should have at least noted that. I was reluctant to pursue adding the private network into sites and services because it is foreseeable that 2 sites could possibly use the same subnet. Honestly, this is an area in which I am not well versed. If this is a possible solution, I presume that the initial joining of a PC to the AD would still be a slow process, but later access would be optimized by cached hints from the Sites and Services configuration?

share|improve this question
1  
Hi Cactus, It seems that you have a problem with your sites definition. Do you have a AD Site defined for the "narrowed" and isolated network?. Bear in mind that you also should have associated its correspondant subnets objects in order to work properly. –  SantiFdezMunoz Nov 5 '13 at 16:58
    
"I think all that needs to happen is for the client to select a local DC, but I am not aware of a mechanism or setting that allows for this" - Make sure Active Directory Sites and Services is correctly set up for your Sites and Subnets and make sure that the affected clients are using the correct site DC's for DNS. –  joeqwerty Nov 5 '13 at 17:02
    
Don't have identical subnets in different locations if you're using a service (like AD) that needs to be able to talk to (and from) those locations. That just won't work well. –  mfinni Nov 5 '13 at 17:33
    
Although I fully agree with @mfinni, you still can hardcode the site on those clients on the isolated network. Modify the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\SiteNam‌​e (REG_SZ) and put there the name of your "isolated" site. You can find more information at TechNet: Finding a Domain Controller in the Closest Site. Nevertheless I must insist on this is far from being a advisable or best practice. Hope this may solve your issue :) –  SantiFdezMunoz Nov 6 '13 at 8:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.