Deploy active directory ONLY on the cloud and join workstations to it WITHOUT VPN (No DCs on premise, No RODCs etc.)

Question

The company does not have any offices. All users are remote.

However, they need an Active Directory to which workstations can be joined and users can be centrally managed.

One suggestion is to purchase a server on the cloud (AWS, Azure, Rackspace etc.) and deploy Active Directory on it and then join the workstations to this Active Directory.

With this setup, what are the implications of not using a VPN from the end user's workstation to the server instance on the cloud? Has anyone done this without VPN?

Answer 1

You would want to protect your AD DC servers from the internet. Exposing them directly isn't best practice. The VPN is there to help prevent that. You can use the built in Windows VPN services which while not all that great would at least give you something better than nothing. Here is a link to a MS best practices guide for Active Directory. Best Practices for Securing Active Directory Might want to review it before proceeding further. Page 78 reviews a bit about simply using Internet Explorer on a Domain Controller as failing best practice. That alone should give you an indication that exposing Active Directory services on the internet is a bad idea.

Answer 2

To your specific question - what are the implications? Domain Controllers in a default configuration are not hardened for a public network, for example, they permit cleartext LDAP binds by default which might expose your passwords to interception. This article describes the process to disable LDAP simple binds https://support.microsoft.com/en-us/kb/935834

Depending on what you hope to achieve from a machine/user management perspective you should investigate the following technologies

Microsoft Intune can provide management of non-domain joined machines including Mac/Linux using Configuration Manager

Windows Azure Active Directory allows you to centrally create and manage user accounts and provide an ADFS authentication interface for various applications including Office 365.

DirectAccess allows for a Domain Joined experience while connected directly to the Internet by building an VPN tunnel to your cloud hosted network before authentication.

Workplace Join is a capability of ADFS that will permit you to "join" a device to your domain via the ADFS service.

Windows Azure can provide SMB shares over the Internet. But file shares are a legacy technology - use Sharepoint Online/OneDrive if you can.

Policies can (sort of) be done using Windows Intune - you won't get traditional Group Policy configuration, but you generally don't need that unless you want to lock down your environment.

Internet printing can be setup in Windows 2012 https://technet.microsoft.com/en-us/library/jj134159.aspx - but you would need a server somewhere for it. A cloud service undoubtedly exists.

Good Luck

Shane

Answer 3

Don't do this with traditional AD DS. If you have to go cloud-only, you should use the Azure Active Directory SaaS solution with Intune for management and Windows 10 on the desktop. You lose things like Kerberos, GPO, etc, but you gain a great amount of flexibility and have no infrastructure to manage.

As I said, this isn't a 1:1 comparison of features between AAD and AD DS, so do some research and make sure it's a good fit, but this is the only plausible solution to your question, unless you completely ignore security best practices and place a DC on the public internet.