Join Log in
Score:0
avatar Server

Local windows clients can't reach Azure IaaS Domain Controller

kr flag
LightGFX

At work, we wanted to migrate our domain controller to an azure VM.

Azure AD and Azure AD DS doesn't fulfill our needs. Like GPO etc..

Well, let's say : I had 3 windows clients : CL1 (win10), CL2(win10), CL3(win7) and my domain controllers are : OnPremDC - ip : 192.168.0.10 || AzureDC - ip : 10.1.0.5

What I did first was to join CL1,CL2,CL3 to OnPremDC, so I changed the DNS settings manually of each client to 192.168.0.10 ==> No surprise, everything worked.

After that, for the migration : I configured a VPN S2S connection between OnPremDC and the Azure vNET, I joined AzureDC to the local domain, promoted it to domain controller, installed DNS server, File server and what is necessary.

Now what I want to do : is to decommission OnPremDC but before doing that I need to be sure that local clients (CL1 - CL2 - CL3) are pointing towards my DC on AZURE.

The thing is that when I connect to the client, I can't ping the AzureDC :

Ping 10.1.0.5 doesn't work on the clients, but on the OnPremDC I can.

So my question is : how can I connect my on-prem clients to the AzureDC ?

And AFTER IT IS DONE, How can I change the DNS servers for all my clients at once and make it : 10.1.0.5 instead of 192.168.0.10 ?

Thanks in advance for your answers !

28
1 + 2
joeqwerty avatar
cv flag
joeqwerty
Ping isn't an Active Directory testing tool. Can the clients reach the DNS server on the Azure DC? Test it by running nslookup in interactive mode on a client and specify the Azure DC as the server to use (server x.x.x.x). As for how to change the clients to use the Azure DC you need to configure the clients primary DNS server as the Azure DC.
1
Reply
joeqwerty avatar
cv flag
joeqwerty
As an aside, you're introducing a dependency that may not be appropriate or desired. If you decommission your on premises DC then you're completely dependent upon the Azure DC being available to your domain clients. That means your internet connection needs to be up and the S2S connection needs to be connected at all times.
1
Reply
Score:0
avatar Server
ng flag
Sam Cogan

ICMP traffic is blocked by default by Azure network security groups, so ping won't work unless you enable it. That said, it's not a good test of AD connectivity anyway.

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.