Domain Membership

There are pros and cons to joining an Edge Server to an internal Active Directory domain. From a security perspective, it is undesirable because an Edge Server behaves identically whether it is joined to a domain or not. By not joining the Edge Server to the domain, the attack exposure is limited and there is no way a compromised Edge Server has any Active Directory information.

From a management perspective, though, having an Edge Server or multiple Edge Servers in a workgroup configuration creates some additional issues, such as security policy enforcement and patching. Administrators must manually account for patching these servers, changing local security policies instead of using Group Policy and Windows Server Update Services (WSUS). By not being part of the domain, these servers can potentially be left unpatched with security vulnerabilities.

There are workarounds to these issues, such as using registry keys to point servers at an internal WSUS server or allowing Edge Servers to automatically update patches. However, organizations might block the ports required for WSUS to a perimeter network or not want servers to apply patches without being tested first.

If the Edge Server is part of a workgroup configuration, be sure to define a primary DNS suffix for the machine and use that fully qualified domain name in the Topology Builder and for any certificates using the internal server name.