Domian Controller Best Practice

Question

Hi, We have an environment with HUB/Spoke design. several DCs globally connected and replicating. These DCs are onboard vessels connected via satellite. there are times that we lose connection, it could be from a few minutes to a few weeks. What would be the best approach and best practice in our case? RODC would be the best practice? What would be the best replication interval in the above case?

Answer 1

Hello Thank you for your question and reaching out. I can understand you are having query\issues related to Domain controller best practice. The suggested solution is to install a read-only domain controller (RODC) at places with insufficient physical security. Plan to install the fewest number of regional domain controllers possible to guarantee cost effectiveness. Review "Geographic Locations and Communication Links" first. For each domain that is represented at each hub site, local domain controllers are placed on the local area network. Consider whether regional domain controllers need to be installed at satellite locations once you have installed them in each hub location. The cost of supporting a remote server architecture is reduced by removing unused regional domain controllers from satellite locations. Additionally, make sure that domain controllers in hub and satellite locations are physically secure to prevent unauthorised access. Avoid installing writable domain controllers at hub and satellite sites where you cannot ensure the domain controller's physical security. A person who has physical access to a writable domain controller can attack the system by:

• Accessing physical disks by starting an alternate operating system on a domain controller.
• Removing (and possibly replacing) physical disks on a domain controller.
• Obtaining and manipulating a copy of a domain controller system state backup. Reference : https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/planning-regional-domain-controller-placement --If the reply is helpful, please Upvote and Accept as answer--