We've received a request from a vendor who wishes to join two computers from their network into our AD Domain. The vendor is proposing to provide a vertical application installed on their servers from their Datacenter. Their network will be connected to ours over a VPN.

It seemed unusual, but they treated it like business as usual. Is this a common practice we are unaware of?

NOTE: They are not requesting a cross domain trust relationship -- they want membership in our domain.

1 Answer 1


So.. these computers are off your network, in their space, accessing your AD? How are you establishing that? Are you doing a site-site VPN? Most importantly: why? What benefit do you both hope to realize? Since this is your AD and they are a vendor, I'd really want to see how this benefits you. Why do they want to do this with 2 AD-joined computers in their data center when there are many other ways to transfer data back and forth?

It's not unheard of, but it's unusual. Who maintains their user accounts (it sounds like you do)? Who supports the PCs? What kind of group policies do they expect to get? Why do they need access to your AD? Who maintains their access to ensure that the accounts expire when they leave the vendor company? What kind of access do they need in your network? Are you restricting their logins to only those devices? How long do they want this for?

This is a request for your legal folks as well. There needs to be a Non=Disclosure agreement as well as indemnification. Also a Business Partner Agreement that severely restricts their conduct needs to be in place.

Personally it would take an awful lot for me to agree to this. I'd really want to understand what they hope to gain from that and how they propose to implement it.

  • We thought it was unusual -- but their matter of fact attitude gave me pause. We pushed back and prevailed, but management is looking at us a bit funny. I believe the vendor is looking to lessen their admin workload by joining -- but of course we are concerned about the security risks of allowing an external entity into the domain. I know it's a long shot, but do you know of any best practice documents on AD that cover this topic?
    – user590028
    Feb 9, 2018 at 13:08
  • "Act as if". Make the client think that your unusual request is normal, and they may just accept it. Unfortunately I don't off the top of my head. I assume that their vertical app is returning data back to you; there are lot of ways (REST, etc.) to get that back internal. Feb 9, 2018 at 19:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .