I am a network administrator and my windows support partner recommended to open active directory to public internet. reason is dns is configured on active directory with same server. But i never done this previously and he asked to update all servers directly from internet. but we have wsus and working fine.

have you any idea about this recommendation?

closed as off-topic by Greg Askew, Gerald Schneider, Ward Mar 8 at 1:25

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions should demonstrate reasonable business information technology management practices. Questions that relate to unsupported hardware or software platforms or unmaintained environments may not be suitable for Server Fault - see the help center." – Greg Askew, Gerald Schneider, Ward
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    No, you should not do this. What do you mean by this statement reason is dns is configured on active directory with same server.? – joeqwerty Feb 21 at 13:27
  • dns has been configured on same server. Both Active Directory and DNS. – serverAdmin123 Feb 22 at 3:23
  • 1
    As @Joeqwerty sort of said, It is strongly not recommended to do this if you simply MUST expose that DNS do so with a standalone DNS server and some reverse proxy service back to it. Each domain controller is a container for your organization's most privileged accounts, exposing it directly to the internet would be to put your organization at risk. – Kyp Feb 24 at 15:51
  • While MIT Kerberos alone was designed to be secure on the global Internet, Microsoft's implementation is its own, and AD includes many other components which may or may not be safe to operate outside a firewalled network. Don't do it. – Michael Hampton Feb 26 at 4:14

No no no no no no no.

As others have said, if you need to do external DNS, create a separate server and host the required records on that behind a proxy.

Or consider creating a separate namespace for whatever it is that needs inbound connections, and have that hosted by your upstream provider (if your internal domain is a .com, use a .net for external stuff, or some other name variation). What is it that needs external DNS records? And access to internal resources? Managed devices?

  • thanks for your response. but when i blocked internet connectivity for my active directory no users are able to access internet? – serverAdmin123 Feb 26 at 5:36
  • Um, what are you talking about? If you're talking about the fact external DNS lookups are failing, who is your upstream DNS provider? Put some DNS proxy servers in your perimeter network (not in the same network as your domain) and allow them port 53 to your upstream DNS. Configure them to forward queries to upstream DNS. For your domain controllers, configure their DNS forwarders to point to the DNS proxies. Your clients should be using a WEB proxy as well! – Trix Feb 26 at 8:26
  • thank you so much. for your answer, our dns provider is local domain provider. – serverAdmin123 Feb 26 at 8:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.