Webserver on DC

[nsanto17]

Is there any harm with placeing a webserver open to the public on a Domain Controller?

I know ideally it should prob be a seperate box but i am not sure we have the funds for it right now. I do NOT want to place my network at risk with opening up IIS to the public that is on a domain contoller.

Thanks for your comments and thoughts.

 

[Roadki11]

I would say thats an absolute no no. IIS is well known for security issues. I would never allow access to any service running on a DC from outside the trusted LAN.

RoadKi11

"This apparent fear reaction is typical, rather than try to solve technical problems technically, policy solutions are often chosen." - Fred Cohen

 

[mrdenny]

There usually should be anything on a DC except for AD.

Denny
MVP
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / SQL 2005 BI / SQL 2008 DBA / SQL 2008 DBD / SQL 2008 BI / MWSS 3.0: Configuration / MOSS 2007: Configuration)
MCITP (SQL 2005 DBA / SQL 2008 DBA / SQL 2005 DBD / SQL 2008 DBD / SQL 2005 BI / SQL 2008 BI)

My Blog

 

[58sniper]

I think Denny means there shouldn't be anything on a DC except for AD.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[Zelandakh]

SBS negates these arguments! It is Exchange and a DC and DNS and IIS...

It *can* be done, it just should be avoided.

 

[pagy]

I actually quite like Denny's statment, it would really shake things up a bit ;-)

Yeah, try to avoid a DC doing anything other than being a DC if possible.

a low cost desktop with 2k3 on it to run iis would be better than running a public web site on your DC.

What is the website for? is it a corporate site? e-commerce?


Paul
MCTS: Exchange 2007, Configuration
MCSA:2003
MCSE:2003
MCITP:Enterprise Administrator

RFC 2795 - The Infinite Monkey Protocol Suite (IMPS)

http://www.faqs.org/rfcs/rfc2795.html

 

[nsanto17]

The site is going to be used a company support site which will require users log-in via asp pages. Once users have been logged in they will have access to view asp pages that access the company database. We are going to expand this out to our business partners so they can log in and see the status of there files with us. I already have IIS running on a 2000 server but i wanted to switch it over to 2003 and add a certificate for secure connections.

 

[mrdenny]

Pat's correction, is correct. The brain is faster than the fingers.

Is it possible? Yes, just about anything is possible. Microsoft gives you plenty of rope to hang yourself.

Just because you can do it, doesn't mean that you should.

Denny
MVP
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / SQL 2005 BI / SQL 2008 DBA / SQL 2008 DBD / SQL 2008 BI / MWSS 3.0: Configuration / MOSS 2007: Configuration)
MCITP (SQL 2005 DBA / SQL 2008 DBA / SQL 2005 DBD / SQL 2008 DBD / SQL 2005 BI / SQL 2008 BI)

My Blog