Not my bread and butter so I hope I'll be clear enough. I have number of Windows 7 workstations running behind firewalls out there in the wild. I have an Active Directory inside my corporate organization, behind a firewall. I'm very limited on what I can do on the firewall...opening a port or two might be fine but that's it.

Bottom line, I need to centralize my users and policies via the Active Directory. Can I do that via VPN? how will the first authentication happen?

Can I do that through SSH tunneling (assume that I have the proper infrastructure in place which obviously can run only after login)?


1 Answer 1


The first thing you need to do is join each workstation to the domain. In order to do that, each workstation needs to be able to communicate with the Active Directory Integrated DNS server (this is the domain controller). What you should absolutely not do is open ports for unencrypted AD traffic from remote workstations to your domain controller. This is such a bad idea I'm not even going to discuss it.

Can I do that via VPN? how will the first authentication happen?

Yes, you can use a VPN. If you do, each workstation will need to be connected to the Internet first, then authenticate with a local account or AD account using cached credentials, then authenticate to the VPN. This is the wrong way to do this. I have seen many people try to do it this way and please for the love of all IT administrators don't do this. You will only create more problems that will need fixed later. More importantly, this will work horribly. :)

Better options are using a site-to-site VPN at each office where there are workstations that are joined to the domain or paying your ISP to establish a layer 2 circuit between each office and the main office where the domain controller is located.

The best solution is to have a DC at each office and then connect each office using a layer 2 circuit to the main office. AD authentication and updates occur at each local DC and the local DCs synchronize changes with the DC at the main office via the layer 2 circuits.

Making product recommendations is off topic for server fault, but the bottom line is you need to establish connectivity between each workstation and the domain controller. Another way to do this is to bring each workstation to the network where the domain controller is and join the workstation to the domain but this is really not the proper way to handle this. If you are going to have these workstations at remote locations and you need them joined to the domain then you might want to research site-to-site VPNs and layer two circuits you can buy from your current ISP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.