Domain vs Workgroup Resiliance - Slight different question....

[prossi]

Hi All,

I've got a question that's been bugging me for a while, so I thought I'd get your views.

I'm an experienced network administrator, with a lot of experience designing resilient network systems and infrastructures for large companies. However, I am now in charge of a small network where 100% up time is vital, but the environment is extremely volatile. Power could be cut at any time, and there are sometimes extreme weather situations which could affect hardware. I have around 40 users working from laptops who access the network in my satellite site and connect back to a main network infrastructure at the head quarters via a WAN connection that I provide. The issue is, the laptop users utlise a domain infastructure back at head quarters and up until now have been accessing this domain at my satellite via a different AD site. This is ok about 80-90% of the time. However, in the event that the primary AD controller falls over and the backup also falls over, you are then left in a tricky situation. Also if there are replication issues, you are then also left in a tricky situation. I also had a problem a few months ago, where a user left the satellite site and went to work from home, when he got there, the laptop would not let him login until it could authenticate him against the domain. Until he returned to the site to access the network he could not login. This is a one off situation, but I want to avoid it again, that's why I think having a centralised domain is not the ideal situation for my users. However, it could have seriously comprimised our business.

Is there another way that I could be going about doing this? Or should I create local copies of all of their domain profiles into local user accounts and let them use them, while they are with me and then copy them back for when they are at headquarters? If this is the case, is there a tool out there that offers this? Or should I just start writing one (I'm a competent Delphi and VB developer)? In the time that I've been administering and designing networks, I've never come across a situation like this. That's why I'm asking......

What do you think?

 

[mrdenny]

Here's my sugestions.

Put a DC at the remote site incase the WAN link goes down. Enable cashed credentials on the users workstations. That will allow them to log in even if they aren't connected to the network.

I wouldn't use local accounts on the machines ever. You don't want the users to have to log in to a different account when they aren't connected. Which is when the cached credentials come in handy. I would also setup a VPN server so that the people that need to work from home can log in to the network as needed and get what they need from the office. This should keep them from keeping sensitive files on there laptops.

If there is a need for a copy of the files to be kept on the laptops using offline files to keep a local copy, then when ever they are connected to the network (either locally or via VPN) the offline files will be synced with the copy on the server.

Denny

--Anything is possible. All it takes is a little research. (Me)