We have geographically distributed employees Across India. Most of the employees join in remote location and they rarely have to travel to regional offices. e.g. employees in Goa would rarely need to travel to regional office in Mumbai.

Now we are installing Active Directory in our office (Azure, Virtual Machine Hosted). Whats the best way to join laptops (Windows) in remote locations to this AD? Asking them to travel to a office to get this done doesn't seem to be the right way.



Point to Site VPN or DirectAccess is an option but depending on your VPN solution and its security configuration (user certificate, NACK control,...) it may be too much difficult to connect for a end user

If you have Windows 8 and later, you should use Offline Domain Join (https://technet.microsoft.com/en-us/library/offline-domain-join-djoin-step-by-step(v=ws.10).aspx) : During an offline domain join, a computer is configured to join a domain without contacting a domain controller. This makes it possible to join computers to a domain in locations where there is no connectivity to a corporate network.

If your Windows workstation are running Windows 10, you have some improvement or options to join organisation Information System :

1- an option can be to use Azure Active Directory Join (http://blogs.technet.com/b/ad/archive/2015/05/28/azure-ad-join-on-windows-10-devices.aspx) . In that case, your user can join Windows to Azure AD very easyly (they need to know their email & password). It's possible to write back on AD on premise device object created on Azure AD.

2- You can use a provisionning package (https://technet.microsoft.com/en-us/library/dn986866(v=vs.85).aspx) to include every parameters to simplify connectivity to AD on premise (Clients Certificate, MDM enrollment..)

hope this help.




How far away is the closest office to them? Goa to Mumbai would be way too far, but if they're an hour away, it may be the most cost effective route to have them come in to that office.

Do the employees go to any office normally? Or do they work from home? In either case, an IPSec VPN from their firewall/router to your firewall would produce good results. But it'll take a long time to set up a VPN for each individual employee/router configuration. It would be best if they all congregated within a few buildings or other employee's houses for the procedure.

A third option would be to mail them all new laptops already configured and set up. I did this for one client, and it was the easiest way I've ever done it, but it was the most expensive route. It's worth investigating if the company is looking to upgrade to new laptops though.

Something that is not an option: doing this across the Internet without a VPN/tunnel. For both security reasons, and the likelihood it wouldn't even work.

  • Actually Goa/Mumbai was just an example. We have users across every nook and corner of country. As new users are being added to the system, there are already enrolled in AD. Question is about 1000 users who already exist in system. – Thoughtful Monkey Dec 18 '15 at 8:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.