Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Short version: How do you prevent an Active Directory 2012 R2 Domain Controller from advertising the domain on a specific interface? I want that network to not be flagged as a domain network, and no domain services should be available.

Environment: A self-contained AD for managing a small hyper-v cluster and the related VM's. The DC also runs the VMM server and has access to the production network because of the need to reach the VMM console.

Long Term Goal / Potential Solution: I would like to have absolutely no non-VMM traffic reach the production network. I have considered just blocking all non-vmm outgoing connections with the windows Firewall, but I don't know how to force a particular profile on an interface.

Thanks!

share|improve this question
    
You can switch an interface to be on a "private" network instead of "domain" within the network and sharing center. Then, you can configure the firewall with the different profiles –  Nathan C May 9 at 14:47
    
Are you sure that option exist on a DC? I can't find it anywhere :( –  Chance May 9 at 15:02

1 Answer 1

up vote 3 down vote accepted

If the domain controller is not part of your production AD but instead manages its own one, it will not advertise itself as a domain controller for your production domain(s). It should of course use itself as its DNS server, thus it will not even talk to your production DNS servers.

Furthermore, you can disable all Microsoft networking protocols on the production network by unchecking the "Client for Microsoft networks" and "File and printer sharing for Microsoft networks" on the network interface connected to your production network, and also by disabling NetBIOS on the TCP/IP properties of the same interface; TCP/IP will remain operational and you will thus be able to RDP into the server and even connect to the VMM console, but no Windows-style networking will take place on that interface.

You should also disable DNS registration on the production network interface, or your internal DNS will get polluted by the DC registering its production-facing IP address for internal domain services.

share|improve this answer
1  
This is exactly what I needed, succinct, and includes additional concerns I may not have thought off. Excellent answer, thank you. –  Chance May 9 at 15:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.