Domain Membership Considerations

Edge Servers do not store any directory information or user data, but they should never be joined to an internal Active Directory domain. Edge Servers are typically deployed in workgroup mode, which can create some additional issues, such as security policy enforcement and patching. Administrators must manually account for patching these servers, changing local security policies instead of using Group Policy and Windows Server Update Services (WSUS). By not being part of the domain, these servers can potentially be left unpatched with security vulnerabilities.

There are workarounds to these issues, such as using registry keys to point servers at an internal WSUS server or allowing Edge Servers to automatically update patches. However, organizations might block the ports required for WSUS to a perimeter network or might not want servers to apply patches without being tested first.

Another option is to join Edge Servers to a separate Active Directory forest that has been deployed within the perimeter network. Some businesses deploy a separate forest to work around the management and maintenance issues previously discussed.

If the Edge Server is part of a workgroup configuration, be sure to define a primary DNS suffix for the machine, and use that FQDN within Topology Builder and for any certificates.