I am new to Active Directory and I need to implement AD for an organization that has two larger locations and 5 smaller locations, all connected via an MPLS network. Here is a simplified diagram of the network:


The main reason for implementing AD here is central authentication & user maintenance (and possible group policies). No roaming profiles, no Exchange, no file shares or other resource sharing.

The remote locations (C-G) have no servers and given the small number of workstations in these sites and their limited use of AD, I really do not want to install DCs with related infrastructure, cost & administrative overhead in those locations.

I plan to only use one domain, but have not yet decided on OUs, etc. (but overall I am trying to keep things simple).


  1. Are T1s sufficient for this use of AD (the 5 stations at each location will typically only login 1-2 times / day)? Or is it likely to be very slow to login & bog down the T1s?
  2. Can I use only one site (despite the current 3Mbps link @ site B [to become a 10 Mbps in ~2 months])? If not, how about putting both DCs @ Site A?
  3. Other design recommendations for this scenario (remember, I am an AD noob)?
  • All domain controllers in one site would be a single point of failure. If all computers use DC1 and DC2 for primary and secondary DNS, it will probably work fine. – Greg Askew Nov 23 '16 at 2:09
  • Just another thing to consider, if any of the sites have the possibility of being comprised, you should consider using a read only domain controller, or RODC instead of fully featured DC. DNS should also be a consideration, especially if you are going to do AD integrated DNS. – Brett Larson Nov 23 '16 at 6:46

AD authentication requires very little bandwidth, especially if you aren't going to be sharing files over the network. At my company, we have 20-some retail stores with POS stations running Windows 7, and they connect to our main office with DSL lines, most of which are 3 Mb/s down and 768 Kb/s up. They have absolutely no issues with domain authentication, and we even push Windows updates via WSUS over those lines. I don't anticipate you would have any problems at all with having a DC at only one location.

  • That sounds good. Are you saying that you only have one DC for the whole network and have never had an issue? It sounds a bit risky... – Zek Nov 23 '16 at 0:48
  • No, we have 2 DC's, but they are both located at the main office. Therefore, that fact is not really relevant to the question. – Charles Burge Nov 23 '16 at 8:08
  • Actually, that was one of the questions (#2); I might also decide to place both DCs in the same location. Thanks for your input! – Zek Nov 23 '16 at 16:38
  • Sorry, I had missed that part. DC's in multiple locations is a good idea if it's feasible. That way, you're protected against a catastrophe at one location, such as fire, tornado, etc. The bandwidth needed to keep them synchronized is very minimal. – Charles Burge Nov 23 '16 at 17:07
  • 1
    I know I'm jumping in late but based on your diagram I'd recommend putting a DC in each of your larger sites if at all possible. 2 reasons for this are reliability and DNS resolution speed. on the reliability front you don't want your whole company down due to a power or network outage at a single site, spreading the DC's fixes this. as for DNS while AD auth traffic is lightweight and it doesn't really matter if it takes 1 second or 3 that time delay definitely does matter for DNS lookups when browsing the web, and placing a DC at siteB will greatly improve their lookup speed. – Mike Garuccio Nov 23 '16 at 20:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.