I need assistance designing the Active Directory domain topology for a new branch office. Below is my case:

We currently have 100 users working out of a single office with network range of Everyone is part of the same example.com AD domain and connected to the Internet with the gateway from the same subnet. We are planning to open a new office in a different location in the same city. 50 users will be shifting from the current location to the new location.

I will be configuring the point to point VPN between both offices where my gateway from network will communicate with a possible gateway of The aim is direct communication between clients in both offices. The 50 users in the new office will have static IPs assigned.

With my primary AD and DNS servers in the main head office, how will devices in the new office communicate with AD-DNS servers for getting regular updates from AD, DNS queries, and generally be in sync with the domain controller? Is there any requirement for bringing a new server for the new office which can act as the AD/DNS server for these 50 clients?

I don't wont to make any changes to end user computers and I expect all the configuration to be server-side only.

  • if you have static IP's on the desktop, you'll have to change the end user computers. – Rex Feb 26 '18 at 16:21
  • My advise: forget AD at first. Get the VPN and client<->client communication working for any random network device you connect. Do that, and the AD stuff should be pretty easy. – Joel Coel Feb 26 '18 at 19:36

So now the question will be, My primary AD and DNS servers are in main head office. As 50 users relocating to new branch office with the static IP assigned to the their systems. How they will communicate with AD-DNS servers for getting regular updates from AD, DNS quarries and to be in sync with the domain controller.

Is there any requirement for bringing new server in new office which can act as AD/DNS server for this 5 clients. Also, I don't wont to make any changes to end users computer and expecting all the configuration in the server side only.

They'll communicate the same way they do now, except that communication will take place across the VPN connection.

There's no requirement that you place a DC/DNS server in the remote office, but it's probably advisable to do that.

| improve this answer | |
  • Thanks for your inputs. client systems suppose to communicate in a normal way with AD/DNS once VPN device connects them on that network. But I believe it will cause latency in DNS resolution at branch office systems. For this purpose they required nearest AD/DNS to resolve the query instead of servers from main office answers them. So basically here I am little confused over the required server setup. I am more fa-miler with changes required at network side rather than the servers. Although, basic changes required in AD/DNS should work for me. – user205223 Feb 26 '18 at 20:09
  • Sure. Having a DC/DNS server in the remote office would be beneficial, but it isn't required. Your question is very broad in terms of what's the best and recommended way of doing this. My answer is very narrow and answers only the crux of your question. – joeqwerty Feb 26 '18 at 20:11
  • Agreed. your answer works for me. just curious about the latency issues for branch office users. If configuring the AD-Site in branch office decreases DNS response for systems then probably more than happy to take those efforts. – user205223 Feb 26 '18 at 20:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.