Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I hope someone can help. I'm currently setting up my first VPN on a Windows Server 2008 R2 box and every tutorial I've found says to configure Active Directory first. I've not actually done that before, either, so I was wondering if it was completely necessary?

Also, what type of VPN would you recommend? L2TP/IPSec or SSTP?

Thanks for any help.

share|improve this question
up vote 4 down vote accepted

If RRAS is installed and configured on a machine that is not a member of the domain, it will use the local accounts database rather than Active Directory, the setup process is the same.

With regards to the protocol, they are both good options. Both make use of certificates, SSTP gives you the advantage that it uses port 443, which should mean you have minimal firewall issues. L2TP operates at the IP layer, whereas SSTP operates at the TCP layer, if that has any bearing on your choice.

share|improve this answer
Thanks for that. How do you create certificates without Active Directory, though? I really want to be messing around with AD as little as possible because this machine has to connected to another machine and I want the least amount of configuration issues possible. Thanks again – Django Reinhardt Nov 23 '09 at 18:08
From my research it seems it ISN'T possible to have a VPN without AD CS installed, unless you want an unsecured VPN, of course. (That's not full AD, however, just the Certificate Server.) – Django Reinhardt Nov 24 '09 at 9:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.