Hardening a DC/Domain for DMZ deployment

[Dinkytoy]

Hi,

We're currently building a new domain for deployment in our DMZ. It's required due to a need for a SQL cluster. Our plan is to create a new forest and domain and setup a one way trust from the LAN domain to the DMZ domain.

The trust aside, does anyone have any tips or advice for hardening the DC(s) in the DMZ somewhat for added protection?

There does seem to be little information about this out there.

Thanks.

 

[Zelandakh]

Install a Windows 2008 RODC.

 

[Zelandakh]

I suppose a Server 2003 x64 ADAM would be ok too.

 

[58sniper]

Security Configuration Wizard
Learn it
Use it
Love it

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[TechyMcSe2k]

R u needing an exposed SQL server only? if so, maybe the use of an ISA server(to hide the SQL cluster), along with the SQL cluster in the DMZ is all you would need. And as Pat stated; the SECURITY CONFIG WIZARD is your friend.