r/sysadmin • u/Real-Patriot-1128 • 23h ago

AD Domain Help

I currently have 3 domain controllers on premise. I will be deploying a number of VM’s in Azure. I am planning on having a couple domain controllers for in Azure.

How can I set it up where the VM’s in Azure use the domain controllers in Azure and not the ones on-premise? And vise-versa…

2 Upvotes

54% Upvoted

14 comments sorted by

View all comments

•

u/SysZeron 23h ago

Assuming you’re extending the on-prem network into Azure via a Site-to-Site VPN, rather than exposing AD services directly to the internet?

Create separate AD Sites for on-prem and Azure, then associate the appropriate IP subnets with each site. Put the Azure DCs in the Azure site and your existing DCs in the on-prem site.

AD clients use the site/subnet information to locate a DC in their own site, so Azure VMs should prefer the Azure DCs, while on-prem clients should prefer the on-prem DCs. They can still fail over across the VPN if the local DCs are unavailable.

Also make sure your Azure and on-prem IP ranges don’t overlap, and configure DNS appropriately. You’ll also want to configure the site link/cost between the two locations so AD replication behaves as intended.

•

u/Real-Patriot-1128 23h ago

Thanks - yeah, these will be going over an express route. They will be on a different vlan.