From a security point of view, does it make sense to connect the Windows servers that are running within the DMZ and should be reachable from the Web to the AD (running within the core network)? Or rather manage them by a DMZ AD or just standalone?
In my understanding it is a security risk to leave ports open towards the core network, but there may be a demand for an adequate solution when it comes to managing large scale environments? Are there any other approaches out there like e.g. placing them on AWS/Azure and managing through a Cloud AD separated from the network?