Hello, i have a case with a company having 20 retail shops connected through vpn to their central offices using ADSL / VDSL lines. On the central offices, they have a Windows 2012 R2 A.D. Domain. On the retail shops, they have 5 to 15 pc's per shop with windows 10 Pro, in workgroup environment and they are using a third party tool to have a basic management of them.
Every shop has a Windows SQL 2014 server for their SQL/ ERP system. Those SQL Servers connects to the central offices via SQL replication to exchange data with the central's offices SQL Server. Every shop's pc have his ERP client connecting to their local SQL server to use their ERP system. The goal is to have every shop capable to function and sale their products to customers coming in, even when the Internet or the vpn is down (something that is happening now and then).
Because we are talking about retail shops, they are using heavily printers to print receipts and invoices to retail customers coming in and shopping. For some specific reasons related to local IRS taxing rules, the print jobs have to be processed by a special software installed on one (and only) of the shop's pc, lets say PC1. That's forcing us to have the printer, who is printing the invoices and receipts, installed on that pc locally (via usb) since the software doesn't have the ability to redirect printings to network printers. That printer is shared and connected through windows 10 printer sharing using \PC1\Printer_Shared_name on all shop's pc's.
That configuration works in general reliable and without issues.
Bu they want to have a better control on the shops pc's and i 'm examining the case to have them joined to company's A.D. Domain.
In some tests we have made, we joined all the pc's of one shop's (6 pc) to Active Directory, we configured A.D. Sites IP's to have them pointing to the correct domain controllers and we tried to operate the shop with that configuration. But we faced the following issue:
Almost every day, all the pc, except the PC1 (the pc with the usb printer), at some point fail to print. Examining the problem, i can see that they cannot open the shared printer queue e.g. using \PC1\Printer_Shared_name.
I have to restart the print service on the PC1 to have them print again. As far as i understand, at some point during the day, the Kerberos Authentication fails (due to an interim vpn failure or a timeout due to a loaded vpn line).
I know that i could setup a Domain Controller on every shop. But this will add administrative load to the admins because with that configuration they will have to manage +20 domain controllers at remote sites all over the country. The option to join all those remote pc's to Azure A.D. neither helps due to unreliable (xDSL) Internet lines.
Is there any other option, to have those shop's pc's to be members of the company'e A.D. domain and print reliable, even when there is no Internet or VPN availabe, without having to introduce 20 domain controllers, one on every shop?
Thank you in advance, George.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(150.4, 1%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGM%3C/text%3E%3C/svg%3E)
