Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In a location that has 1 T1 connection with ~ 40 - 50 ms ping latency to the closest domain controller, about how many normal users would it take before you would recommend putting a domain controller there with a windows 2003 environment.

The T1 is used for the internet, and their file server and email server will not be with them in that location. There is also some VOIP going over that T1.

share|improve this question
up vote 5 down vote accepted

As I read the OPs post, there is only 1 data line to this remote site. If so, then the answer to my question below is most likely negative...

In my (limited) experience, it is not a matter of performance, it is a matter of uptime.

How much work could those remote users get done if the T1 is down, and what is the expected and worst-case reliability of that T1? Could a remote DC provide authentication and DHCP/DNS for the users so that a 'meaningfully large' set of applications would continue to be available, even if the T1 is down?

If the site is dead in the water as soon as the T1 is down, i.e. the remote users can't really get any meaningful work done without that data link, then a remote DC makes no sense IMHO. The same goes if the site has lots of meaningful work to do, but that work doesn't require any IT systems. But if the DC could enable the use of other IT systems, then it is valuable.

If you set up a remote DC, then think about Windows 2008's Read-Only Domain controllers, and consider moving other services closer to the users for performance.

share|improve this answer

If there are no other servers in that location as you state (file server and email server are remote to them) then I wouldn't bother putting a DC there at all. Why bother with maintaining it (even if that maintenance is minimal) or powering it/cooling it, etc.? There really isn't any point of authenticating them locally if they aren't accessing any server resources there (this includes print services, which you didn't mention so I'll assume they connect via TCP/IP or have locally attached printers).

You also asked "how many normal users would it take before you would...":

In my opinion on that, once you get above 10 users or so I would recommend combining some roles and putting a DC that also acts as their local file/print server in that location. Used to be their was a stigma about having a DC running file/print services, but I think it works just fine for 10-30 users.

share|improve this answer
I guess I should have added the DC would also be DNS ... – Kyle Brandt Sep 11 '09 at 13:47
What about Outlook/Exchange? The client will connect to a directory server as well as Exchange. Can give some speed up if the directory controller is close. – Ryaner Sep 11 '09 at 13:48
@Kyle - So the clients will get their DNS resolution from the remote DC unless there is one locally? That's fine, just make sure their secondary DNS server is something on the internet so that they can still get to the internet, etc. when "headquarters" is unavailable (assuming t1 is still up to the internet). – TheCleaner Sep 11 '09 at 13:51
@Ryaner - If you set a DC that is a GC in the remote location this is "supposedly" true, however I've never seen any stats that show it as worthwhile with a small number of users especially with that decent of a connection. – TheCleaner Sep 11 '09 at 13:52
It is still a best practice to NOT put other roles (such as file/print server) on a domain controller. – SturdyErde Mar 26 '12 at 14:29

I wouldn't bother with a DC at all unless you had both a significant enough number of users as well as IT staff on-site. Domain authentication can be quite efficient across WAN links, and XPs cached authentication will handle the rest.

The one major gotcha would be if you had a local Exchange box there and weren't running in cached mode; GAL lookups can be quite murdersome in such circumstances.

share|improve this answer

I recommend deploying AD when you need to authenticate for using local services. E.g. if users at the location access each other's computers, if they have a local server, etc.

share|improve this answer
Sounds reasonable, but why does that make sense? – Kyle Brandt Sep 11 '09 at 13:32

The number of users is irrelevant. Can you rely on sufficient bandwidth always being available when required for AD traffic? Is the connection reliable enough to meet your needs? From your description I suspect the answer to this is yes but only you can know for sure. Regardless, if it was my network they would have their own DC (and file server, etc.). I've been a victim of someone higher up the tree deciding my location didn't need a DC. Long term it just ends up costing more if productivity is affected.

share|improve this answer

We run a hundred remote offices in that range without DC's. Authentication traffic is too small to justify the (total) cost of a machine. I have found that the "coattails" approach works in the long run; users will complain of slow browsing/mail first (not C+A+D time), then pressure for bandwidth, then AD traffic will ride the coattails of that and viola no DC needed. Remote DC's are painful=cost to support and can be insecure.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.