setting up remote dc that will access main SBS server via VPN

Have an SBS2003 Prem server w/ISA2004, and a Win2003 box. the win2003 server
i want to setup as a remote domain controller at a branch office, able to
replicate and access the complete SBS network. Main office IP is static,
branch is dynamic with TZO. Will be using RRAS to handle the routing.

Anyone know of fairly specific documentation on exactly how to do this? I
want the branch office users to have full access to the folders on the SBS
server.

cgtech <> wrote:
> Have an SBS2003 Prem server w/ISA2004, and a Win2003 box. the win2003
> server i want to setup as a remote domain controller at a branch
> office, able to replicate and access the complete SBS network.

It ain't going to replicate anything but AD, note.

> Main
> office IP is static, branch is dynamic with TZO. Will be using RRAS
> to handle the routing.

I wouuldn't do that. Use hardware firewall/routers to create an IPSEC VPN
link.
>
> Anyone know of fairly specific documentation on exactly how to do
> this?

Nothing special. Set it up as a member server and dcpromo it. Put it in its
own AD Site & subnet. Ship it off to the branch office.

> I want the branch office users to have full access to the
> folders on the SBS server.

That has nothing to do with your local DC - it has to do with NTFS
permissions, joining the workstations to the domain, etc.

You state to put it in its own AD Site and subnet - not exactly sure what you
are refering to here. I've setup additional DC's before, but this will be the
first for a branch office, so am a little hazy on exactly how to make it
work.

"Lanwench [MVP - Exchange]" wrote:

> cgtech <> wrote:
> > Have an SBS2003 Prem server w/ISA2004, and a Win2003 box. the win2003
> > server i want to setup as a remote domain controller at a branch
> > office, able to replicate and access the complete SBS network.
>
> It ain't going to replicate anything but AD, note.
>
> > Main
> > office IP is static, branch is dynamic with TZO. Will be using RRAS
> > to handle the routing.
>
> I wouuldn't do that. Use hardware firewall/routers to create an IPSEC VPN
> link.
> >
> > Anyone know of fairly specific documentation on exactly how to do
> > this?
>
> Nothing special. Set it up as a member server and dcpromo it. Put it in its
> own AD Site & subnet. Ship it off to the branch office.
>
> > I want the branch office users to have full access to the
> > folders on the SBS server.
>
> That has nothing to do with your local DC - it has to do with NTFS
> permissions, joining the workstations to the domain, etc.
>
>
>

cgtech <> wrote:
> You state to put it in its own AD Site and subnet - not exactly sure
> what you are refering to here.

What it means is that the branch office users will always authenticate to
their local DC unless there is a major problem and they can't find the SBS
box on the WAN.

> I've setup additional DC's before, but
> this will be the first for a branch office, so am a little hazy on
> exactly how to make it work.

Open AD Sites & Services. Create a new site for the remote location, with
the approriate IP subnet for the remote location.

Rename the built in/ default site to something logical such as HQ.

When you've set up the DC in your own office, change its IP to the
appropriate one for the remote network (also make sure you've set up DHCP on
it for that network) and shut it down. Move it in AD Sites & Services to the
right site. Ship it off and have them turn it on when it's connected




>
> "Lanwench [MVP - Exchange]" wrote:
>
>> cgtech <> wrote:
>>> Have an SBS2003 Prem server w/ISA2004, and a Win2003 box. the
>>> win2003 server i want to setup as a remote domain controller at a
>>> branch office, able to replicate and access the complete SBS
>>> network.
>>
>> It ain't going to replicate anything but AD, note.
>>
>>> Main
>>> office IP is static, branch is dynamic with TZO. Will be using RRAS
>>> to handle the routing.
>>
>> I wouuldn't do that. Use hardware firewall/routers to create an
>> IPSEC VPN link.
>>>
>>> Anyone know of fairly specific documentation on exactly how to do
>>> this?
>>
>> Nothing special. Set it up as a member server and dcpromo it. Put it
>> in its own AD Site & subnet. Ship it off to the branch office.
>>
>>> I want the branch office users to have full access to the
>>> folders on the SBS server.
>>
>> That has nothing to do with your local DC - it has to do with NTFS
>> permissions, joining the workstations to the domain, etc.

Lanwench [MVP - Exchange]
< hoo.com> wrote:
> cgtech <> wrote:
>> You state to put it in its own AD Site and subnet - not exactly sure
>> what you are refering to here.
>
> What it means is that the branch office users will always
> authenticate to their local DC unless there is a major problem and
> they can't find the SBS box on the WAN.

Correction - unless there is a major problem *locally* in which case they
will go look for the remote DC. :-)
>
>> I've setup additional DC's before, but
>> this will be the first for a branch office, so am a little hazy on
>> exactly how to make it work.
>
> Open AD Sites & Services. Create a new site for the remote location,
> with the approriate IP subnet for the remote location.
>
> Rename the built in/ default site to something logical such as HQ.
>
> When you've set up the DC in your own office, change its IP to the
> appropriate one for the remote network (also make sure you've set up
> DHCP on it for that network) and shut it down. Move it in AD Sites &
> Services to the right site. Ship it off and have them turn it on when
> it's connected

and make sure DHCP is giving out both DNS servers ... .local is first,
remote is second. Same thing in the main office, but in reverse. And each
server should point to itself first for DNS, then the other.
>
>
>
>
>>
>> "Lanwench [MVP - Exchange]" wrote:
>>
>>> cgtech <> wrote:
>>>> Have an SBS2003 Prem server w/ISA2004, and a Win2003 box. the
>>>> win2003 server i want to setup as a remote domain controller at a
>>>> branch office, able to replicate and access the complete SBS
>>>> network.
>>>
>>> It ain't going to replicate anything but AD, note.
>>>
>>>> Main
>>>> office IP is static, branch is dynamic with TZO. Will be using RRAS
>>>> to handle the routing.
>>>
>>> I wouuldn't do that. Use hardware firewall/routers to create an
>>> IPSEC VPN link.
>>>>
>>>> Anyone know of fairly specific documentation on exactly how to do
>>>> this?
>>>
>>> Nothing special. Set it up as a member server and dcpromo it. Put it
>>> in its own AD Site & subnet. Ship it off to the branch office.
>>>
>>>> I want the branch office users to have full access to the
>>>> folders on the SBS server.
>>>
>>> That has nothing to do with your local DC - it has to do with NTFS
>>> permissions, joining the workstations to the domain, etc.

Excellent. That is what i was looking for. Thanks for the help!

"Lanwench [MVP - Exchange]" wrote:

> cgtech <> wrote:
> > You state to put it in its own AD Site and subnet - not exactly sure
> > what you are refering to here.
>
> What it means is that the branch office users will always authenticate to
> their local DC unless there is a major problem and they can't find the SBS
> box on the WAN.
>
> > I've setup additional DC's before, but
> > this will be the first for a branch office, so am a little hazy on
> > exactly how to make it work.
>
> Open AD Sites & Services. Create a new site for the remote location, with
> the approriate IP subnet for the remote location.
>
> Rename the built in/ default site to something logical such as HQ.
>
> When you've set up the DC in your own office, change its IP to the
> appropriate one for the remote network (also make sure you've set up DHCP on
> it for that network) and shut it down. Move it in AD Sites & Services to the
> right site. Ship it off and have them turn it on when it's connected
>
>
>
>
> >
> > "Lanwench [MVP - Exchange]" wrote:
> >
> >> cgtech <> wrote:
> >>> Have an SBS2003 Prem server w/ISA2004, and a Win2003 box. the
> >>> win2003 server i want to setup as a remote domain controller at a
> >>> branch office, able to replicate and access the complete SBS
> >>> network.
> >>
> >> It ain't going to replicate anything but AD, note.
> >>
> >>> Main
> >>> office IP is static, branch is dynamic with TZO. Will be using RRAS
> >>> to handle the routing.
> >>
> >> I wouuldn't do that. Use hardware firewall/routers to create an
> >> IPSEC VPN link.
> >>>
> >>> Anyone know of fairly specific documentation on exactly how to do
> >>> this?
> >>
> >> Nothing special. Set it up as a member server and dcpromo it. Put it
> >> in its own AD Site & subnet. Ship it off to the branch office.
> >>
> >>> I want the branch office users to have full access to the
> >>> folders on the SBS server.
> >>
> >> That has nothing to do with your local DC - it has to do with NTFS
> >> permissions, joining the workstations to the domain, etc.
>
>
>
>

cgtech <> wrote:
> Excellent. That is what i was looking for. Thanks for the help!

Most welcome!
>
> "Lanwench [MVP - Exchange]" wrote:
>
>> cgtech <> wrote:
>>> You state to put it in its own AD Site and subnet - not exactly sure
>>> what you are refering to here.
>>
>> What it means is that the branch office users will always
>> authenticate to their local DC unless there is a major problem and
>> they can't find the SBS box on the WAN.
>>
>>> I've setup additional DC's before, but
>>> this will be the first for a branch office, so am a little hazy on
>>> exactly how to make it work.
>>
>> Open AD Sites & Services. Create a new site for the remote location,
>> with the approriate IP subnet for the remote location.
>>
>> Rename the built in/ default site to something logical such as HQ.
>>
>> When you've set up the DC in your own office, change its IP to the
>> appropriate one for the remote network (also make sure you've set up
>> DHCP on it for that network) and shut it down. Move it in AD Sites &
>> Services to the right site. Ship it off and have them turn it on
>> when it's connected
>>
>>
>>
>>
>>>
>>> "Lanwench [MVP - Exchange]" wrote:
>>>
>>>> cgtech <> wrote:
>>>>> Have an SBS2003 Prem server w/ISA2004, and a Win2003 box. the
>>>>> win2003 server i want to setup as a remote domain controller at a
>>>>> branch office, able to replicate and access the complete SBS
>>>>> network.
>>>>
>>>> It ain't going to replicate anything but AD, note.
>>>>
>>>>> Main
>>>>> office IP is static, branch is dynamic with TZO. Will be using
>>>>> RRAS to handle the routing.
>>>>
>>>> I wouuldn't do that. Use hardware firewall/routers to create an
>>>> IPSEC VPN link.
>>>>>
>>>>> Anyone know of fairly specific documentation on exactly how to do
>>>>> this?
>>>>
>>>> Nothing special. Set it up as a member server and dcpromo it. Put
>>>> it in its own AD Site & subnet. Ship it off to the branch office.
>>>>
>>>>> I want the branch office users to have full access to the
>>>>> folders on the SBS server.
>>>>
>>>> That has nothing to do with your local DC - it has to do with NTFS
>>>> permissions, joining the workstations to the domain, etc.