Child domain DC down for a month,can users still vpn and authenticate?

[Ceez]

Hello everyone. I have a confusing situation.

One of our remote offices is relocating and unfortunately they'll be without an office for at least a month because of leasing issues and considering it's been downsized to only 4 people they will be working from home, 2 will be taking their desktop home and the other 2 have laptops. All will vpn using the cisco client

This child domain consists of a single DC running Server03r2, AD integrated with DHCP. If we power down that DC and move it to storage for a month, can the users still vpn in and log in with their cached credentials? It is my understanding that each DC in the network (3 childs+root) has a copy of each others AD info. Meaning that when they VPN they will authenticate through the cisco asa and then if they need to access resources on any of the other domains within our network they can get through because these domains have the same info as the down DC? Sorry a bit confusing.

And in regards to email, we have exchange03 which mailboxes reside in our main office. Again, with their DC down, can they log in via webmail? They will be login onto their mailbox that sits in the main office but how does authentication work?!?!

It all boils down to: will they need that DC to powered on and part of the network? If so, that's almost impossible since they will need the MPLS network wherever they decide to leave it.

Please help me clear this up.

Thank you for reading.

 

[pagy]

can the users still vpn in and log in with their cached credentials?

AFAIK cached credentials never expire.. so users will be able to log into these laptops and desktops at home.

It is my understanding that each DC in the network (3 childs+root) has a copy of each others AD info.

Each DC in the same domain has copies of all domain info such as user accounts, groups etc. You stated that this DC was a single domain controller for a child domain so no other DC in the forest will have those user accounts on them..

To understand this better you have to know what DCs do replicate. They replicate 3 partitions;
schema - replicated to all DCs in the forest
configuration - replicated to all DCs in the forest
domain - contains all domain related info, OUs, groups, users etc and is replicated amongst domain controllers in the same domain.

Meaning that when they VPN they will authenticate through the cisco asa and then if they need to access resources on any of the other domains within our network they can get through because these domains have the same info as the down DC?

Now I don't know how the cisco bits work here but the other DCs cannot authenticate these users as you said they were part of a child domain that had a single DC that is now in storage..

I can't see the exchange stuff working either as the exchange box will have no DC to authenticate the users against.




I would say that the single DC that runs the child domain needs to be powered on and available..

Paul
VCP4

https://www.mcpvirtualbusinesscard.com/VBCServer/PaulP/profile

RFC 2795 - The Infinite Monkey Protocol Suite (IMPS)

http://www.faqs.org/rfcs/rfc2795.html

Difficult takes a day, impossible takes a week