Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

For my small company i want to setup a domain controller

  • I want users to be able to access the domain controller from their laptops via the internet.
  • I need the DC for policies & management of users.
  • I'm aware of the consequences of exposing the DC to the Internet.
  • Yes at some point there might be a VPN on the Computers / DC.
  • Would like the machine to be hosted on AWS EC2 instance.

My problem is that i tried already doing it my self ,but i might be missing something.

  • Say my company is called mycompany.com.
  • I have already created a machine with the DC. (Windows 2008 rc2 DataCenter edition)
  • I assign a static IP using EC2 Elastic IP Address
  • I created a subdomain DNS record to direct dc.mycompany.com to the static IP (Using GoDaddy).
  • When i ping the address (Or remotly connect) to dc.myxompany.com the server responds. for the sake of it my company is www.company.com

But when i try to add computers to the DC , it constantly fails.

what i get is:

The following error occurred when DNS was queried for the service location (SRV)
esource record used to locate an Active Directory Domain Controller (AD DC) for domain 
"dc.mycompany.com":

The error was: "DNS name does not exist."
(error code 0x0000232B RCODE_NAME_ERROR)

The query was for the SRV record for _ldap._tcp.dc._msdcs.dc.mycompany.com

EDIT: Following the comments below. i'm doing it for research purposes to understand what will work for my company and what will be the end solution that will be suggested. i have managed many AD before, but i have never tried to do it with some of my users being able to access it from the internet. I'm also using this method to test VPN providers like F5 & CheckPoint to go along with this solution. As for EC2 & AWS As it easier to experiment with that environment rather than using actual servers inside my company.

Any help will be much appreciated.

{Please don't leave comment like don't do it.}

share|improve this question

closed as off-topic by voretaq7 Nov 7 '13 at 23:46

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must demonstrate a minimal understanding of the problem being solved. Try including attempted solutions, why they didn't work, and the expected results. See How can I ask better questions on Server Fault? for further guidance." – voretaq7
If this question can be reworded to fit the rules in the help center, please edit the question.

8  
Don't don't don't don't don't. Use VPN. Do not expose your AD to the internet under any circumstances. –  MDMarra Nov 7 '13 at 23:04
2  
If you think this is in any way a good idea when you don't understand why it's currently failing then please drop me email - I've got a business proposal for you involving some real estate, shares and releasing the bank account of a deceased nigerian general. –  symcbean Nov 7 '13 at 23:20
1  
@kobymeir I've closed this question because you are not articulating a good reason for grossly violating best practices. Server Fault is a site for professionals, which means we expect questions and answers to be asked in a professional capacity, which then means if you don't want us to tell you NO you need to tell us WHY. If you update your question with sound, well-thought-out reasons for what you want to do it may be reopened, but we are against foot-shooting as a rule. –  voretaq7 Nov 7 '13 at 23:49
    
@MDMarra as i knew you will be answering my q, i asked not to write don't do it –  koby meir Nov 8 '13 at 6:08
1  
@kobymeir I didn't answer your question, I left it as a comment. If you went to a gun shop and told them you were planning on buying a gun to shoot yourself in the foot, they would try and talk you out of it. Same thing here. –  MDMarra Nov 8 '13 at 12:16
show 3 more comments

1 Answer

Ignoring how unbelievably insecure this idea is going to be...

I created a subdomain DNS record to direct dc.mycompany.com to the static IP (Using GoDaddy).

OK, but what about the rest of the zone? As the error states, it's looking for a SRV record. This likely doesn't exist in your public zone hosted with GoDaddy.

Obligatory: Why on earth are you trying to do this? What's wrong with implementing something like a DirectAccess VPN?

share|improve this answer
    
could you direct me to a how to on DirectAccess VPN? –  koby meir Nov 8 '13 at 6:25
    
If your DC is currently exposed to the Internet, unfirewalled then the first thing you need to do is start again. You can no longer be certain that your systems haven't already been compromised. –  Chris McKeown Nov 8 '13 at 10:25
    
Ok i will restart the server from scratch, that is easy in AWS EC2, but how does that answer my question? –  koby meir Nov 8 '13 at 10:58
    
Have you perchance tried Googling for 'setting up DirectAccess server 2008 r2'? If so you would find this –  Chris McKeown Nov 8 '13 at 13:44
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.