2

Due to certain limitations, a particular AD site cannot have local DCs, nor can site-to-site VPN tunnels be established to other sites. Instead, the domain members here use point-to-site/dial-in VPNs to connect to remote DCs.

The domain members can reach and access the DCs fine via the VPN, however, due to firewall and the nature of point-to-site VPN, the domain controllers won't be able to ever establish connections to these isolated domain members.

Is this permanent one-way design okay for these domain members? Or will there be any complications when it comes to certain features/scenarios?

1
  • 1
    I'm curious, is the VPN connection established pre-login? Also, what do these clients use for DNS? Are they using the AD DNS servers?
    – joeqwerty
    Mar 10, 2019 at 16:20

3 Answers 3

1

Applying some group policies requires connectivity to a DC during startup: tasks run as startup scripts or software deployment may access the files on the SYSVOL only during system startup.

If the VPN connection is established after that, those clients may never run those tasks or update those software, and you'd have to change your deployment procedures accordingly.

1
  • Thanks! So other than the startup tasks and GPOs, is it okay of DCs can never initiate connections to these domain members? Is anything in AD that requires DCs to reach out to domain members instead of the other way around? Mar 10, 2019 at 13:27
1

I've never had a need for domain controllers to initiate contact with domain members. This design is essentially the same as a work from home community that is exclusively point to site VPN. If DirectAccess was used, there would be no difference at all, but DirectAccess is a dead end product.

A typical issue in this scenario is if someone cannot logon with cached credentials, they may be down until they take/ship their computer to a location that does have connectivity with a DC.

3
  • Unless there's a local account that can be used for credential cache recovery through the VPN. Adding such an account might be a good workaround. Mar 10, 2019 at 17:30
  • Thanks. I do have laptop users who regularly take them offsite and use P2S VPN. It's just that with these users, the machines would at least get on the internal network every once in a while, even if only a few times a year. I never had a scenario where the machines would stay on P2S permanently from the beginning, so just wanted to make sure there's no ill side effect this way. When you mentioned the cached credentials failure, you were talking about the scenario where the 10 default cached logons are exceeded and a user cannot authenticate without VPN connectivity at logon time, right? Mar 10, 2019 at 19:31
  • @user683202: Yes, but actually the default is 25.
    – Greg Askew
    Mar 11, 2019 at 15:03
0

Some VPN clients (Cisco did a few years ago at least) can be configured to allow a session to be started before Windows login.

My laptop connects to the company network just a few times a year via VPN and onsite maybe annually. And untill recently worked perfectly well - even routine password changes somehow worked without VPN being active. So it can be done, but I can't tell you exactly how, although I don't block any outgoing ports and my router shows it's keeping a huge number of NAT sessions open at times so something interesting is going on.

I freed it from corporate control of Windows update which might well be helping (maybe they've relaxed it too?) as I generally self-manage, although I still get other mandatory updates from the IT team.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .