AD with no Internet access available

[Olaf Berli]

I'm setting up a Win2k server in a small office environment where Internet
access isn't allowed due to security issues. In the LAN there is simply no
external communication at all. Will there be any problems using AD in this
setup? I'm thinking of time updates, DNS handling etc.

-Olaf-

 

[Jerold Schulman]

I'm setting up a Win2k server in a small office environment where Internet
access isn't allowed due to security issues. In the LAN there is simply no
external communication at all. Will there be any problems using AD in this
setup? I'm thinking of time updates, DNS handling etc.

-Olaf-

No, but see tip 5414 in the 'Tips & Tricks' at http://www.jsiinc.com

Jerold Schulman
Windows: General MVP
JSI, Inc.
http://www.jsiinc.com

 

[Paul Bergson {MCT, MCSE}]

There should only be one machine as the time manager and believe it is the
role holder of the PDC Emulator. All other machines look to it for time
(2000 and greater) otherwise use net time to point them to it. No problems
with dns, wins or anything else. There is no need to be connected to the
internet for anything.


Paul Bergson MCT, MCSE, CNE, CNA, CCA

 

[Enkidu]

What about security and other updates? Some mechanism would be needed
to cater for these.

Cheers,

Cliff

 

[Olaf Berli]

Have to do this via CD. Since there is no external connection, the security
risks aren't very high.....

-Olaf-

===== Originalmelding fra (e-mail address removed) på 24.04.04 01:53

 

[Cary Shultz [A.D. MVP]]

Cliff,

I remember reading a post awhile ago and the poster ( a woman working for
the DOD ) asked a similar question and the response to her post was
essentially "If there is not a connection to the outside then there will not
be a need for the security as the flaws can not be attacked from the
outside". I know what you mean, though. I guess that they can receive the
Security Updates CD form Microsoft. Mine just came in the mail a couple of
weeks ago.

Cary

 

[Enkidu]

Yes, I guess that the Security Update CD will be adequate in those
circumstances, but from a security point of view not being connected
to the outside world does not mean that there is not a need for the
patches and so on. All it needs is one careless person to connect an
infected laptop to the network and.... I think your DoD lady was being
a little naive.

Cheers,

Cliff

 

[Cary Shultz [A.D. MVP]]

I would agree. I would include all hotfixes / patches regardless of
connectivity to the outside world. Let's not forget about the floppy disc
drive from home, either!

Cary

 

[Olaf Berli]

In the case I was asking about, there are also restrictions on bringing
floppies or laptops into the system. This just isn't allowed. I agree,
however, that there should be routines for applying patches and updates on a
regular basis. My concern was initially if AD needed some kind of connection
to the outside world - like time sync etc. in order to operate properly.

-Olaf-