Allow Users to Log In at Different Sites

[Tightpants]

We have two offices a couple of hundred metres apart. We have investigated options for creating a network link between the two offices but it is all too expensive. Consequently we have created a VPN which is adequate but not ideal. Our two servers in the main office are running Windows Server 2003 and one of them is also running Exchange Server 2003. We have set up a workstation in the second office which is acting as a "server" to store the data locally taking the pressure off the VPN.

Our main problem is that users occasionally swap sites. Usually we use roaming profiles which copy back to the local "server" at logoff and this works fine. However the settings need to be different depending on which site they are logging in at.

I am considering setting up two usernames for each person so that they can log in at any machine at either site. I can give permission for both usernames to open their Exchange mailbox which works fine over the VPN.

Is this the best idea? Unfortunately the user profiles are quite complex to create therefore this rules out the option of creating a default user profile which loads at first logon.

 

[jonbush]

i had a similar situation, here's how i resolved it....

got two pentium pc's with two nics in each, installed smoothwall firewall on each (using them as independent firewalls for each site) with static addresses for each internet connection....then configured the firewalls to talk to each other as vpn connectors (this is a configurable option which is quite handy)....it takes a bit of juggling but when it works, it's cool

of course, all things depend on your internet connection speeds....

for the sake of a couple of old desktops, its worth a try !

smoothwall can be downloaded from smoothwall.org and is fairly simple to do, but is a good firewall.....

hope this helps you...

Jon.

=======================================
I know i've got it backed up somewhere!
=======================================

 

[Tightpants]

The VPN is working fine using a couple of Draytek routers. The problem is that the link is so slow that the roaming profile will not load from the remote office.

For example... User1 is set up as a user in the main office. User1 has a roaming profile so they can log into any workstation in the main office. User1 then goes and works in the other office. They log in and are authenticated via the VPN link however the link is too slow to load their profile. They end up with a basic setup.

My thought was that I could create a second user, User1a, with settings appropriate for the remote office. The only problem is that the two profiles won't be identical and it will take time to create the profiles I need.

 

[sab4you]

either way it sounds like you need to sync the user profiles.

Even if you have them logon to a different user account, and want the same profile, it would still have to be copied over at least once, and synced up at certain intervals.

If you dont care to have the profile sync'd then you could possibly solve it - otherwise you need a better link. There is no other way to get a large amount of data from one office to another quickly.

 

[jonbush]

maybe, if you use folder re-direction to a share on the server, (thus moving the big "my documents" issue) make sure all the users e-mail is held on the exchange server, rather than a .pst file, and maybe....hmmm, here's a thought...have a dhcp server on each site, then jig a logon script to check the ip address, thus identifying thier location, enabling you to pick and choose where their network drives are mapped, which profile to use etc

just a thought....dont forget a dc on each side of the road that replicates, if you put the profiles in the replication path, then profiles will be the same on both sites ( if you config replication through the night, and maybe at midday you might get away with it)

Jon.

=======================================
I know i've got it backed up somewhere!
=======================================

 

[Tightpants]

It is not essential that the user profiles in each office are perfectly synchronised therefore the idea of using two usernames may be the answer.

I will look into folder redirection and replication in more detail however I think there will be too much data to replicate over night. Our Cached Exchange Mode seems to create a huge file in the profile - a bigger problem than My Documents!

I like the idea of using the IP address to identify the location because we do have a DHCP server in the second office and a different IP address range. It would certainly help the users because they wouldnt have to think about which username to use, and I wouldnt have to worry about changing the Mailbox permissions. Can you point me in the direction of a sample script.

Thanks for your help!