I've been tasked with moving an asp.net web app from an old 2003 server as part of an organisation's complete move to new servers. The app uses Active Directory authenication, of which I have little experience.
The app and iis currently sit on the domain controller, but they want to move it onto its own box. My question is: does the app need to reside on the DC or can it sit on its own virtual server? I imagine so but don't want them configuring a server if not
No, the app does not need to reside on the DC.
Running IIS at all on a domain controller is generally frowned upon from a security standpoint. Though some organizations painted themselves into a corner by making their AD domain FQDN match the public facing website name.
One thing to look out for is if the connection string uses Integrated Security. Small thing to change once outside the DC/AD, but something to consider. As with the previous answer, you might need to fully qualify the computer names or use internal IPs instead - eg, if you db server is on a different box, and its name is DB1, the DC would resolve this name to an IP. Moving to a set up without a DC means you might need to IPs instead
