Branch offices present a unique challenge for an organization's I.T. staff.
Branch offices usually are smaller sites in which no data center exists.
Additionally branch offices might not have a secure facility in which to house server sound.
There might be few if any local I.T. staff to support the servers.
If a wide area network link separates a branch office from your hub site depending on the number of
users and the services that are available in the branch office you must decide whether to place a domain
controller in the branch office ADT is in Windows Server 2008 and newer versions support a new type
of domain controller a reader only controller or raw DC which deploys in this type of environment.
There are several reasons for deploying Reuters CS.
If you do not deploy the main controller in a branch office you must use a when link to direct authentication
and service ticket activities to the Hub side.
When a user first tries to access a specific service the user as client requests as a service ticket
from a domain controller user is typically connect to multiple services during a very good day so service
ticket activity happens regularly.
Authentication and service ticket activity over when link between a branch office and a hub site can
result in slow or unreliable performance.
If you place a domain controller in a branch office authentication a accuracy more afraid efficiently.
However there are several potentially significant concerns which include the following domain controller
maintains a copy of all objects attributes and its domain including secure information such as user
passwords.
If a hacker accesses or steals a domain controller or its hard drive or backup drive determined malicious
user could identify valid usernames and passwords.
At that point your entire domain is compromised and you would have to resend passwords for every user
and computer account in the domain server security branch offices.
Often is not ideal.
So a branch office domain controller poses a considerable security risk.
Another reason is that changes to the Active Directory database on a branch office domain controller
replicate to the hop side and to the environments are the domain controllers.
Therefore corruption to a branch office domain controller poses a risk to the integrity of the organization
ideas.
For example a branch office administrator who performs restoration of the domain controller from an
outdated backup could cause significant problems for the entire domain.
Another concern is that a branch office domain controller might require maintenance such as the installation
of new device drivers to perform maintenance on a standard domain controller.
You must sign in as a member of the administrators group which means that you effectively are an administrator
of the domain.
It might not be appropriate to grant the level of capability to a branch office support team.
These concerns can leave organizations with a difficult decision.
For this reason Microsoft introduced the raw see which addresses the branch office scenario and the
they see the domain controller that maintains a copy of all objects and attributes in the domain.
Except for the secure information such as password related properties.
If you do not configure Kashin and road as seriously sign in requests from branch office users and forwards
them to a domain controller in the hop side for authentication you can configure a password replication
policy for an Roddy C that specifies the user and computer accounts for rich passwords might be cached
on the road see if any user assigned Zi and by using a road see the euro they see requests.
That user's credentials from a full domain controller.
When the user is a member of the password application policy that applies to Android I see and rather
see can retrieve the password and the full domain controller allows the replication of the secret.
This means that the next time they use a request authentication from the same road they see the ROTC
can perform the task locally while the users who are included in the password replication policy sign
in the ROTC builds its cache of credentials so that it can perform authentication locally for those
users.
Normally you add a user or send computers to their password through application bullies who are in the
same physical side as a road is C because the rider sees maintain only a subset of user credentials
security exposure is limited.
Even roads C is compromised or stolen even roads is compromised only the user and computer accounts
that there are roads that cached must have their password to result the euro to the application process
also enhances security and ruthlessly replicates changes to ADT s from rateable domain controllers but
it does not replicate any data to other domain controllers.
This eliminates the exposure of Active Directory Services to corruption because of changes made to a
compromised branch office domain controller.
Finally Reuters Cs have the equal out of our local administrators group who can give one or more local
support personnel the ability to maintain an ROTC fully without granting them the equal and domain admins
rights.
Now some votes about Rhodes see limitations and considerations to reduce security risks and administrative
costs.
Some domain controller options that are available for rightful domain controllers are not available
for road it sees before you decide to deploy on the road SC.
You should be aware of the following limitations and considerations Rhodes audiences can not be operations
master role holders operations master role holders must be available to write information to the Active
Directory database because of the read only nature of road SC is active directory database it can not
act as an operations master role holder or Odysseus can not be breech hat servers bridgehead service
specifically replicate changes from other sites or notices perform only Inbound Replication so they
can not act as a bridgehead server for a site you should have only one road is super aside her domain.
If you have multiple the rider sees the behavior of Kashin is inconsistent because shared secrets are
only cached if a user assigned saying to that specific road is C. It is likely that one road SC has
the shared secrets and another or in the same site does not have them at all road it says can not authenticate
a cross trusts when a when connection is not available.
If your users and computers are in different domains they can not perform log gardens when the branch
site uses a road it sees and is disconnected from the hub site.
Another limitation is that because aided ESC changes can not be written directly to Android road I see
no replication changes originated at road see.
This means that any changes or corruption that a hacker might make at branch locations can not replicate
from the road they see to the forest.
This also reduces the work load of the hops brew which had servers and the effort required to monitor
replication reduces unit directional replication applies to both aided s and distributed file system
replication.
Another limitation is that road can not support any app properly that needs to update 8 it is interactively
such as Microsoft Exchange server if you are going to deploy exchange server or similar apps in a site
you also should deploy a writer Bill domain controller.
Further if you deploy exchange server at a site you also should have a physically secure location for
your servers.
You can install the domain name system server service on the road SD road users can replicate all abductor
of partitions that DNS users including for as DNS zones and demand DNS zones.
If you install a DNS server on Android a C client can query it for name resolution just as they would
query any other DNS server similar to the edit s information on an ROI they see the DNA zone information
on an Roddy C is read only is and therefore it doesn't support client updates directly from client computers
try to register a resource record in a DNS zone hosted on an abroad is see the Odyssey returns the name
of a full domain controller that contains a writer built copy of the zone to the client the client uses
the full domain controller to register the record.
Okay.
Next up we'll be talking about deploying and road is C.
I'll see you there.