5

I'm considering setting up a windows domain controller in MS Azure within an Azure virtual network. Goal is to be able to centrally manage GPs and users.

Is this even feasible, since the client computers would need to essentially be on the VPN before being able to authenticate?

I guess I could set up a site-to-site VPN connection to our office, but we have some nomadic users that are almost always mobile.

Improve this question
5
  • This is something that almost no one does today. I expect that within 5-10 years, cloud directory services will have become extremely common. Do you really want to be on the bleeding edge of this transition?
    – Skyhawk
    May 25, 2013 at 1:46
  • Maybe... Maybe not. We've been usung Azure since day 1 and the road has been rocky, but fruitful. We are a small outfit with about 20 users spread around the country. I don't really need all that a DC offers ... Just some centralized mgt per the original post above. Does InTune fit that bill?
    – Brian Adkins
    May 25, 2013 at 1:54
  • Is there a main site where you can put a couple of servers running AD? If not, don't set up AD elsewhere.
    – Joel E Salas
    May 25, 2013 at 2:42
  • From the users' perspective, DirectAccess is the cleanest and simplest way to make this work... but Enterprise edition licensing is required even on the client side, and the required configuration is non-trivial to implement in a small-business context.
    – Skyhawk
    May 25, 2013 at 5:37
  • Technical challenges aside, I'd want to ensure that my directory data was being kept within the EU, in order to adhere to the EU's Data Protection Directive. I've never setup an account/contract with MS' Azure, but I know that not all of their datacentres are in the EU. Are you able to insist where your data is kept, or is it at MS' discretion? On the technical side though, putting my DS in the cloud would feel like releasing control of the keys to the vault. It's a mind-set thing, I know.
    – Simon Catlin
    May 26, 2013 at 21:17

3 Answers 3

Reset to default
6

It is definitely feasible and supported to run a domain controller in Azure. It depends on what you're looking to achieve as to whether that's the best option. If you're primarily looking to manage client PC policy and provide authentication, then you generally want a DC close to the machines it services. If most of the users are in an office and you have infrastructure there, it is still a good idea to keep your DC in the office near them. The main reason to put another DC in Azure would be to service applications that you are also putting in Azure VMs that require AD authentication or directory access.

If you are looking to get away from on premise infrastructure and still need traditional group policy and identity management, you could go with DCs in Azure and provide access via a VPN as you said. There is the site-to-site option to extend your network into Azure, or you can take a look at the new point-to-site VPN capability that allows direct VPN access into Azure using an agent installed on each client. This could work well for a small user base.

https://azure.microsoft.com/documentation/articles/vpn-gateway-point-to-site-create/

Remember too that Windows caches credentials, so as long as you get a user authenticated once through the VPN, they won't need to have it running to log in subsequently. Of course, they'll need to log in periodically to apply the latest policy, which might be enforced or encouraged through a logon script, etc.

Hope that helps.

Improve this answer
1

The classical solution to this is to set up a VPN that a computer can use without a user login; the mechanism used is similar to the one from ancient days when someone might dial an internet connection to connect to their domain. Setting this up can be somewhat of a chore because you have to define the VPN connection in such a way that it can actually be initiated through the network connections API without having to load a client program (basically, you have to deploy PPP).

A newer and likely easier way of doing this is to use DirectAccess, which Microsoft have released for this exact use case; a detailed guide is available here. It is basically a VPN solution.

Improve this answer
0

Look into DirectAccess, which works as a SSL-VPN client on the computer layer. I don't think you can run your directaccess server on Azure though, as Azure is TCP only.

The point though, is this: If you need to be able to manage computers outside your datacenter, I'd argue that placing a DC in Azure is a bad deal. It's becoming popular to deploy a DC replica in Azure, but these are deployed for the resiliency of a secondary site and the ability to have cloud-based workloads to AD authentication against it.

You could of course have your users VPN in to a cloud-based DC. But why would they? No user I know of is particularly interested in making sure their computers are getting managed.

So. Microsoft's solution to all this is DirectAccess. It might not be the right fit for you, but it's worth reading up on.

Improve this answer
2
  • DirectAccess also requires IPv6, and Azure doesn't have native IPv6, so you'd have to set up your own IPv6 tunnel as well.
    – Michael Hampton
    May 30, 2013 at 16:56
  • I think I've read somewhere that The 2012 version of DirectAccess works with native IPv4. But that's beside the point.
    – Trondh
    May 30, 2013 at 17:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .