Short question; do all clients need to be able to talk to all domain controllers in a multi-site domain?
The background: I'm currently trying expand an existing domain to be a multi-site domain. I've done a lot of reading of the Microsoft documentation but some requirements and technicalities remain unclear to me. Everything is Windows Server 2012 R2.
To explain a bit of what we've got, we have an existing site, with 2 domain controllers in a separate management network. We then have roughly 100 client servers in separate client networks that all have access the management network that is hosting the domain controllers. Let's call this domain "int.company.com".
Now we're about to set up client servers in a second location, some of these servers will run duplicates of services from our existing site (application level DR replication will be implemented), and some of these servers will run new services. The administrators will be the same staff as the existing site, this is a remote data centre site, not a manned site.
From the various design best practices I've read sticking with a single domain seems like the best way forward given it's the same staff and running identical / similar services.
I've set up the second site with a single domain controller, and created 2 separate sites in AD Sites and Services, and assigned the correct management and client subnets to both sites. There's a permanent site to site VPN, firewall rules to allow the domain controllers to talk to each other, and dcdiag reports all is well on all 3 domain controllers. All 3 domain controllers also run AD integrated DNS servers.
However I'm struggling with connectivity for client servers at both sites. At the moment when you look up "int.company.com" it returns the IP addresses of all domain controllers at all sites, I understand from the Sites and Services documentation that client servers will always lookup their local domain controllers any way, but we also have various applications and 3rd party services using ldap against "int.company.com" which is not site aware. The current site-to-site VPN does not route traffic for client servers, only the management network for the domain controllers.
Ideally the way we'd envisaged this to work is that client servers at site A only talk to domain controllers at site A, and client servers at site B only talk to domain controllers at site B.
So back to the question, do all clients need to be able to talk to all domain controllers? Or does that mean we're better off creating a separate domain with a trust relation to provide more isolation of traffic?
Thanks in advance!