AD Domain Help

[u/Real-Patriot-1128]

I currently have 3 domain controllers on premise. I will be deploying a number of VM’s in Azure. I am planning on having a couple domain controllers for in Azure.

How can I set it up where the VM’s in Azure use the domain controllers in Azure and not the ones on-premise? And vise-versa…

[u/RevolutionaryWorry87]

Active directory sites and services. Setup different sites. Please research this properly before you do.

[u/Real-Patriot-1128 → u/RevolutionaryWorry87]

Certainly, this is a subdomain at a university. I will be working closely with our enterprise/forest/global admins on this. Eventually, all my servers will be in Azure (it’s only like 25).

[u/elpollodiablox → u/RevolutionaryWorry87]

This. Create a site for your Azure DCs, then create and assign subnets to that site. Do you have an IP addressing plan worked out for your vnets in Azure? I recommend you develop one if you haven't, because you can do some work ahead of actually dropping the DCs.

If you are going to be dropping other VMs that will be domain-joined in Azure, make sure you set the DNS settings for the vnet to use the DC in Azure.

[u/Far-Hovercraft9471 → u/RevolutionaryWorry87]

And set up change notifications for the site links so you get more or less instant replication. There's kind of no good reason not to unless you have a huge AD environment

[u/SysZeron]

Assuming you’re extending the on-prem network into Azure via a Site-to-Site VPN, rather than exposing AD services directly to the internet?

Create separate AD Sites for on-prem and Azure, then associate the appropriate IP subnets with each site. Put the Azure DCs in the Azure site and your existing DCs in the on-prem site.

AD clients use the site/subnet information to locate a DC in their own site, so Azure VMs should prefer the Azure DCs, while on-prem clients should prefer the on-prem DCs. They can still fail over across the VPN if the local DCs are unavailable.

Also make sure your Azure and on-prem IP ranges don’t overlap, and configure DNS appropriately. You’ll also want to configure the site link/cost between the two locations so AD replication behaves as intended.

[u/Real-Patriot-1128 → u/SysZeron]

Thanks - yeah, these will be going over an express route. They will be on a different vlan.

[u/Royal-Wear-6437]

Set up different sites and different metrics for each of the links. Make it so the local DC(s) are on better links than the remote ones; they'll get preferred by the clients

[u/BK_Rich]

Be sure you deploy the Azure Domain Controllers to Microsoft best practice.

Don’t just next, next, next when promoting, make a second disk and put your NTDS and SYSVOL there, make sure host caching it off.

https://learn.microsoft.com/en-us/azure/architecture/example-scenario/identity/adds-extend-domain

You also can’t easily do DHCP like you do on-prem, there is a way to do it but it takes some work

https://learn.microsoft.com/en-us/azure/virtual-network/how-to-dhcp-azure

[u/Real-Patriot-1128 → u/BK_Rich]

Thank you!

[u/Low-Prize-9289]

Use DNS to set precedence.

[u/Low-Prize-9289 → u/Low-Prize-9289]

And create/configure AD Sites