Win 2k Offsite Domain Controller / prevent user authentication 1

[peteway]

I have a site that is geographically distant from our corporate/ Headquarters location. I want to deploy a domain controller to it but prevent users from authenticating to it. If I don't set it up as a global catalog server will that take care of it or will I need to do more.
I can if necessary put it on a seconday subnet at that site.
The reason for this is because I want to replicate only at night for DR reasons and the badwidth is limited and there are only a small number of users at that site.
I just want this domain controller to be a 'backup' in case we need it, it will server no other function other than having a working copy of the acive directory database on it.

 

[brontosaurus]

put it on the secondary subnet. then in AD Sites and Services, create a new site and place just this DC inside it. This will have the effect of making workstations communicate with it only in the event of all other DC's in the local site being down.

 

[peteway]

Thats what I was thinking. What about the global catalog thing. I am pretty sure that a user workstation must contact a GC server in order to logon. You think I should do that as well?

How does the workstation determine which site to choose a Domain Controller to use for authenticaion?

 

[brontosaurus]

You should have at least one GC per site as a rule, and usually more depending on your user load. As for the site thing, each workstation determines what site it belongs to as part of it's boot process. It then uses DNS to find DC's in it's site and uses those for authentication.

 

[peteway]

I understand that I should have a gc at each site for logon purposed, but the thing is... I don't want people to use that dc in that site to be able to logon.

currently this remote site has no dc and they authenticate over the wan. once I create another site, currently we only have one, how will the workstation choose which site to logon on using?
ie I will have site A and site B with dc's at each.
I have a wan office which is neither A nor B, how do I control witch site they contact dc's in to authenticate?

 

[brontosaurus]

you create sites by subnet, that's why I told you to put this DC on a separate subnet from your main office. Once the site is created, if you have some workstations on the same subnet as the new DC/site and some not, you can add other subnets into the config if needed, which tells the workstations what site they belong to. That's also how you'd add the WAN office in...

 

[peteway]

Ok, I'll give it a shot.

Thanks for your help.