We have a network of servers and computers on an AD Domain. One of the servers runs a PHP based management system (ERP) and we want to have it accessible on the internet. When I say internet I don't mean on google or anything, just an open port with a sub domain of our website. I'm not worried about the security of the ERP itself (PHP login etc) to be clear, but rather of the way it should (or not) be separated from the network. I have read a lot saying that you should not have a public server on an AD domain but what are the options for managing it short of physical access? And even if we have it on AD, we wont be able to have it on a DMZ. We did think of a VPN buts its a bit cumbersome for users though it may well be our only option. Hopefully I'm making sense because I'm at bit of a loss at how this should be setup.