AD Branch Office Design

Windows 2003 Changes
Windows 2003 makes branch-office deployment and management easier, thanks to several new features. Dcpromo now lets you promote from media, so you can create a new DC without being forced to replicate a large AD and GC database over a small-bandwidth WAN circuit. Simply copy a highly compressed backup of another Windows 2003 DC's system state to the local server, restore it to a temporary location, type

dcpromo /adv

at a command prompt, and restore the system state from the temporary location. (For more information about promoting from media, see "Windows 2003 Dcpromo," September 2003, InstantDoc ID 39767.)

Remote Desktop, which provides terminal services in Windows 2003, offers the ability to connect to the system console (session 0) with the /c option, so you can truly see what you'd see if you were standing in front of the server. And if you have a lot of sites or are contemplating a large DFS implementation, Windows 2003 handles large numbers of sites more gracefully than Win2K does. Windows 2003's Intersite Topology Generator (ISTG) and Knowledge Consistency Checker (KCC) improvements let the largest branch office deployments proceed without any restrictions from AD.

In this article, I've assumed a simple situation with only one domain because a branch office's users are usually in the same domain unlike large offices, which often have multiple domains. However, if one of your branch offices has users in more than one domain, you must analyze the location's requirements separately for each domain.

No article about branch-office deployment would be complete without a reference to Microsoft's Windows 2000 and Windows 2003 guides for the subject. The aforementioned Active Directory Branch Office Deployment Guide is the original, thorough reference on branch office deployment for Win2K. The draft document I have of the Windows 2003 guide has the same name. I also highly recommend the Microsoft Windows Server 2003 Deployment Kit (http://www.microsoft.com/windowsserver2003/techinfo/reskit/deploykit.mspx), even if you don't plan to deploy Windows 2003 in the near future. This exhaustive (4000-page) treatise benefits from Microsoft's 3 years of experience with Win2K. Pay special attention to the deployment kit's Designing and Deploying Directory and Security Services book. Branch-office deployment can be much trickier than large-office deployment, but the guidelines I've presented and the two Microsoft resources can make you an expert.