We have a number of workstations that will live out at remote locations where we won't necessarily have good physical security. We need to make sure that we have complete access to these machines (via remote desktop, group policy, IPMI/remote KVM, etc) so we will be utilizing hardware VPNs at each of the locations. Because we're using a hardware VPN, that means conceivably someone could plug into the port on the VPN, but they would need to have knowledge of our network infrastructure, username/passwords, etc, and we will also be blocking all inbound traffic back to our office at the firewall except for Active Directory traffic.
So, that brought up the issue, what kind of domain controller to use? At first I set up a read-only domain controller that is a member of our primary domain, but even that made us feel uncomfortable. Plus, it has it's own set of pains associated with it, so now I'm considering other options before we really begin using the system (it's still in development).
I'm thinking I'll either set up a child domain or go the route of an entirely separate domain. I would still need to set up trust relationships between the domains, though, as I want my office users to be able to easily manage the remote computers in the field, but it's purely for management purposes and the connection can be severed at any time while still leaving the field computers fully operational. Yes, I could have no trusts at all, but I would like to manage most of the user resources from one domain if possible. The key here is that we have the ability remotely manage and access these computers without allowing them to compromise our office network security.
Is there a better way to do this? What have others done in situations like this? Thanks!