Is Windows 2003 AD domain controller to be set a read only copy in DMZ zone?

[Mugen]

Hi,

We are planning on upgrading NT 4 to W2K3 AD.
I have some questions about replaction and hope someone
will able to help me.

Is it possibe to place a W2K3 DC in DMZ zone? Make it as
a read only copy and replicate with internal coproate DC?
What we are thinking is having oustside users or venderos
to login the read only copy DC from DMZ zone? If that is
possible, can someone tell me how to do that and where to
find these information.

Thanks.

 

[Brian Desmond [MVP]]

You cannot make an AD DC readonly.

--
--
Brian Desmond
Windows Server MVP
(e-mail address removed)12.il.us

Http://www.briandesmond.com

 

[Joe Richards [MVP]]

No you can't makeit read only and it is generally a very bad idea to expose your
internal active directory to possible external breach.

You should use a separate forest or possibly use AD/AM instead of AD.

joe

 

[Mugen]

Thanks for the reply!

How do i use ADAM for our situation? Can you give me some
information and where i can find more information?

 

[joolz]

oh yes you can - make a seperate forest/domain (all in one) and mak
this the dmz domain- to auth users from inside create a one way trus
between the domains and create suitable perm structures.

voila no accounts in the dmz - and a seperate domain to aauth 3r
parties etc..

*Thanks for the reply!

How do i use ADAM for our situation? Can you give me some
information and where i can find more information?

-----Original Message-----
No you can't makeit read only and it is generally a very bad idea to expose your
internal active directory to possible external breach.

You should use a separate forest or possibly use AD/AM instead of AD.

joe

--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net



Mugen wrote: someone[vbcol=seagreen]
as[vbcol=seagreen]
DC?[vbcol=seagreen]
venderos[vbcol=seagreen]
is[vbcol=seagreen]
to[vbcol=seagreen]
.

-
jool

 

[Joe Richards [MVP]]

http://www.microsoft.com/windowsserver2003/adam/default.mspx