Loggin to remote DC VS Own Subnet DC

[David Mah]

We have several remote offices, because of the number of employees in those
offices we have installed a DC/GC in each. However it seems that employees
from the main office are logged on to the remote DCs. All DCs are on their
own site/subnet which I thought was suppose to not let computers from
different subnets to logon to other subnets.
How can I prevent above happening and make those with certain subnets to
logon to the Dc on their own subnet?

Our config is Windows 2003 AD.

 

[Herb Martin]

We have several remote offices, because of the number of employees in those
offices we have installed a DC/GC in each. However it seems that employees
from the main office are logged on to the remote DCs. All DCs are on their
own site/subnet which I thought was suppose to not let computers from
different subnets to logon to other subnets.
How can I prevent above happening and make those with certain subnets to
logon to the Dc on their own subnet?

You cannot "prevent" it -- but you can INFLUENCE it.

Did you create your SITES in "Sites and Services"?

If it looks like a separate LAN (across a WAN) and it has
a DC/GC then make it a separate site.

Then right click on each DC and "move" it to the appropriate
Site.

Make sure your clients are using the "nearest" DNS server
and that you DNS is fully replicated. (You might want each
DC/GC to be an AD-Integrated DNS server unless you have
a LOT of DCs.)

 

[David Mah]

That is exactly what I have done.
All DC/GCs are own their own site which were created in the site and
services and all DNSs are AD Integrated. But I still have this problem.

 

[Herb Martin]

That is exactly what I have done.
All DC/GCs are own their own site which were created in the site and
services and all DNSs are AD Integrated. But I still have this problem.

What problem? (Yes, I know you said they are authenticating
off site but that is BY DESIGN under some circumstance and
how do you know you have "a problem"?)

What DNS settings do the CLIENTS have? Remember that DCs
are DNS CLIENTS too!!!!

Do all DCs have appropriate entries in the DNS _underscore
subdomains, especially the "Site" where they live?

Run DCDiag on each DC and send the output to a text file;
search for FAIL, WARN, ERROR.

IF there is a problem it is likely due to your DCs not having
their NIC set to use themselves as the DNS server, or
incomplete DNS server replication, or (ordinary) clients not
using the right DNS server (local).