1

The company does not have any offices. All users are remote.

However, they need an Active Directory to which workstations can be joined and users can be centrally managed.

One suggestion is to purchase a server on the cloud (AWS, Azure, Rackspace etc.) and deploy Active Directory on it and then join the workstations to this Active Directory.

With this setup, what are the implications of not using a VPN from the end user's workstation to the server instance on the cloud? Has anyone done this without VPN?

  • Perhaps you should be looking at the AWS Simple Directory component. - aws.amazon.com/directoryservice/faqs – joeqwerty Sep 29 '15 at 23:20
  • @joeqwerty Thanks for the suggestion. The company uses Office365 for email, share point etc. for which they use SSO using ADFS. Not sure we can do SSO with O365 using Simple AD – slayernoah Sep 29 '15 at 23:32
  • What about azure ad join blogs.technet.com/b/ad/archive/2015/05/28/… – Jim B Sep 30 '15 at 5:18
  • @JimB Good suggestion! Not sure if Azure join would work since there are macs on the network. Do you know if we can Azure join macs? – slayernoah Sep 30 '15 at 13:44
  • @slayernoah I don't know about Macs, probably worth a phone call to Microsoft on that one, I doubt it though. – Jim B Sep 30 '15 at 19:59
2

You would want to protect your AD DC servers from the internet. Exposing them directly isn't best practice. The VPN is there to help prevent that. You can use the built in Windows VPN services which while not all that great would at least give you something better than nothing. Here is a link to a MS best practices guide for Active Directory. Best Practices for Securing Active Directory Might want to review it before proceeding further. Page 78 reviews a bit about simply using Internet Explorer on a Domain Controller as failing best practice. That alone should give you an indication that exposing Active Directory services on the internet is a bad idea.

  • 1
    I was reviewing this document. It looks like it is a bad idea to deploy standard AD over the internet without a VPN. Thank you for the information! – slayernoah Sep 30 '15 at 21:56
2

To your specific question - what are the implications? Domain Controllers in a default configuration are not hardened for a public network, for example, they permit cleartext LDAP binds by default which might expose your passwords to interception. This article describes the process to disable LDAP simple binds https://support.microsoft.com/en-us/kb/935834

Depending on what you hope to achieve from a machine/user management perspective you should investigate the following technologies

Microsoft Intune can provide management of non-domain joined machines including Mac/Linux using Configuration Manager

Windows Azure Active Directory allows you to centrally create and manage user accounts and provide an ADFS authentication interface for various applications including Office 365.

DirectAccess allows for a Domain Joined experience while connected directly to the Internet by building an VPN tunnel to your cloud hosted network before authentication.

Workplace Join is a capability of ADFS that will permit you to "join" a device to your domain via the ADFS service.

Windows Azure can provide SMB shares over the Internet. But file shares are a legacy technology - use Sharepoint Online/OneDrive if you can.

Policies can (sort of) be done using Windows Intune - you won't get traditional Group Policy configuration, but you generally don't need that unless you want to lock down your environment.

Internet printing can be setup in Windows 2012 https://technet.microsoft.com/en-us/library/jj134159.aspx - but you would need a server somewhere for it. A cloud service undoubtedly exists.

Good Luck

Shane

  • @Neossain Thank you for the detailed alternatives to traditional AD. This is definitely worth looking at! There are three main things that would be provided by traditional AD that the organization leverages extensively (1) sharing of resources (such as file shares, printers etc.) (2) User and workstation policies to standardize workstation settings (3) SSO to Office 365 using ADFS. Would you know if these three things will be supported by the traditional AD alternatives mentioned above ? – slayernoah Sep 30 '15 at 22:19
2

Don't do this with traditional AD DS. If you have to go cloud-only, you should use the Azure Active Directory SaaS solution with Intune for management and Windows 10 on the desktop. You lose things like Kerberos, GPO, etc, but you gain a great amount of flexibility and have no infrastructure to manage.

As I said, this isn't a 1:1 comparison of features between AAD and AD DS, so do some research and make sure it's a good fit, but this is the only plausible solution to your question, unless you completely ignore security best practices and place a DC on the public internet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.