For my small company i want to setup a domain controller

  • I want users to be able to access the domain controller from their laptops via the internet.
  • I need the DC for policies & management of users.
  • I'm aware of the consequences of exposing the DC to the Internet.
  • Yes at some point there might be a VPN on the Computers / DC.
  • Would like the machine to be hosted on AWS EC2 instance.

My problem is that i tried already doing it my self ,but i might be missing something.

  • Say my company is called mycompany.com.
  • I have already created a machine with the DC. (Windows 2008 rc2 DataCenter edition)
  • I assign a static IP using EC2 Elastic IP Address
  • I created a subdomain DNS record to direct dc.mycompany.com to the static IP (Using GoDaddy).
  • When i ping the address (Or remotly connect) to dc.myxompany.com the server responds. for the sake of it my company is www.company.com

But when i try to add computers to the DC , it constantly fails.

what i get is:

The following error occurred when DNS was queried for the service location (SRV)
esource record used to locate an Active Directory Domain Controller (AD DC) for domain 

The error was: "DNS name does not exist."
(error code 0x0000232B RCODE_NAME_ERROR)

The query was for the SRV record for _ldap._tcp.dc._msdcs.dc.mycompany.com

EDIT: Following the comments below. i'm doing it for research purposes to understand what will work for my company and what will be the end solution that will be suggested. i have managed many AD before, but i have never tried to do it with some of my users being able to access it from the internet. I'm also using this method to test VPN providers like F5 & CheckPoint to go along with this solution. As for EC2 & AWS As it easier to experiment with that environment rather than using actual servers inside my company.

Any help will be much appreciated.

{Please don't leave comment like don't do it.}

  • 8
    Don't don't don't don't don't. Use VPN. Do not expose your AD to the internet under any circumstances.
    – MDMarra
    Nov 7, 2013 at 23:04
  • 2
    If you think this is in any way a good idea when you don't understand why it's currently failing then please drop me email - I've got a business proposal for you involving some real estate, shares and releasing the bank account of a deceased nigerian general.
    – symcbean
    Nov 7, 2013 at 23:20
  • 1
    @kobymeir I've closed this question because you are not articulating a good reason for grossly violating best practices. Server Fault is a site for professionals, which means we expect questions and answers to be asked in a professional capacity, which then means if you don't want us to tell you NO you need to tell us WHY. If you update your question with sound, well-thought-out reasons for what you want to do it may be reopened, but we are against foot-shooting as a rule.
    – voretaq7
    Nov 7, 2013 at 23:49
  • @MDMarra as i knew you will be answering my q, i asked not to write don't do it
    – koby meir
    Nov 8, 2013 at 6:08
  • 1
    @kobymeir I didn't answer your question, I left it as a comment. If you went to a gun shop and told them you were planning on buying a gun to shoot yourself in the foot, they would try and talk you out of it. Same thing here.
    – MDMarra
    Nov 8, 2013 at 12:16

1 Answer 1


Ignoring how unbelievably insecure this idea is going to be...

I created a subdomain DNS record to direct dc.mycompany.com to the static IP (Using GoDaddy).

OK, but what about the rest of the zone? As the error states, it's looking for a SRV record. This likely doesn't exist in your public zone hosted with GoDaddy.

Obligatory: Why on earth are you trying to do this? What's wrong with implementing something like a DirectAccess VPN?

  • could you direct me to a how to on DirectAccess VPN?
    – koby meir
    Nov 8, 2013 at 6:25
  • If your DC is currently exposed to the Internet, unfirewalled then the first thing you need to do is start again. You can no longer be certain that your systems haven't already been compromised. Nov 8, 2013 at 10:25
  • Ok i will restart the server from scratch, that is easy in AWS EC2, but how does that answer my question?
    – koby meir
    Nov 8, 2013 at 10:58
  • Have you perchance tried Googling for 'setting up DirectAccess server 2008 r2'? If so you would find this Nov 8, 2013 at 13:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.