In the future my company will have 3 main office. This is my first time i've to manage 'branch offices'. Main site will manage 30 devices (user + device) , secondary branch at maximum 10-15 devices per branch.

All branches will be connected through 8-10 mbit symmetric HDSL lines.

We will have the main office with 1 windows server (2008) with active directory. The others 2 offices will have their server.

So my question is: how will be managed active directory ? We have to configure active directory eithers to the branch offices ? Or maybe we will have to simply 'replicate' main active directory ?

Can you point me some usefuls link that explains how to manage multi sites active directory ?

  • "it depends" :) Please tell us more about your environment. How many users in each office? Do they have permanent VPN link which is "fast enough", what does the "server" do in the branch offices? – MichelZ Jul 19 '12 at 9:29

You have a couple of options.

  1. You can set up child domains at each remote office and have a forest root at your HQ.

  2. You can have a single AD domain that spans multiple sites with domain controllers at each site, which is configured using the Active Directory Sites and Services snap-in.

#2 is recommended by Microsoft now-a-days and you really don't need child domains unless you have an explicit reason to. They are management boundaries, but most management can be delegated easily using the ADUC Delegate Control wizard in modern versions of AD.

I recommend at least 2 DCs at each site for resiliency with either plan, but if push comes to shove, you can get by with 1 at each remote site and at least 2 at the main site.

| improve this answer | |
  • As an addition to your points - if he goes for #1, then he'll really need 2x DC's on every domain. So yeah, #2 for the win. – Dan Jul 19 '12 at 13:24
  • Yeah, definitely. I missed his requirement of 1 server at each site (which is really bad practice). – MDMarra Jul 19 '12 at 13:25

Have a look here: Active Directory Best practices

The recommendation is:

Establish as a site every geographic area that requires fast access to the latest directory information. Establishing areas that require immediate access to up-to-date Active Directory information as separate sites will provide the resources required to meet your needs.

Place at least one domain controller in every site, and make at least one domain controller in each site a global catalog. Sites that do not have their own domain controllers and at least one global catalog are dependent on other sites for directory information and are less efficient.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.