I work with a large Active Directory. We have domain controllers distributed across many sites. At my site we have been trying to create a private network which has access only to a very small list of servers in the larger network. This access is controlled via an access control list on the router. Everything works as we had planned except for Active Directory integration.
We had planned to have a number of Windows PCs inside this private network that would still participate in the active directory, but this is proving troublesome. We are able to make this configuration "work", but not in an acceptable way. Users are able to login using their domain accounts, but only after waiting about 20-40 minutes after entering their credentials.
It appears that the computers inside the private network are attempting to connect to each of the various corporate domain controllers, but due to the ACL they are only successful when they eventually stumble upon our local site DC. I am strongly resisting the temptation to fix this by adding every global DC into the ACL because the intention of the private network was to improve security.
Is there a way to make a configuration like this work? I think all that needs to happen is for the client to select a local DC, but I am not aware of a mechanism or setting that allows for this. I am not a domain admin, but they aren't offering any solutions currently.
Any ideas? Not having Active Directory integration in the private network is a big loss in terms of manageability.
EDIT: Regarding the idea of putting the private network ranges into Sites and Services... This was the direction I expected possible responses to go, and I should have at least noted that. I was reluctant to pursue adding the private network into sites and services because it is foreseeable that 2 sites could possibly use the same subnet. Honestly, this is an area in which I am not well versed. If this is a possible solution, I presume that the initial joining of a PC to the AD would still be a slow process, but later access would be optimized by cached hints from the Sites and Services configuration?