We're designing a SASE setup that requires MFA before users can access on-premises resources. Ideally, domain-joined endpoints should be able to authenticate to Active Directory and receive group policy updates even before the user completes MFA, while exposing as few network ports as possible.
After MFA, users will have normal access to the domain controllers. One concern is updating group memberships: as I understand it, a user's group membership is refreshed when they log out and back in while the device can reach a domain controller. Since most employees work remotely, many devices do not regularly connect to the VPN.
A KDC Proxy seems useful because it can support Kerberos authentication through a single exposed port, including computer and user authentication. However, Group Policy also requires access to the SYSVOL share over SMB, which KDC Proxy does not provide. Windows Server also does not currently support QUIC for SYSVOL.
Could a read-only domain controller serve as the source for Group Policy files while KDC Proxy handles authentication? The environment uses hybrid Active Directory with traditional AD-joined computers and AD-based user accounts. Moving to Entra-joined devices or Entra-based user accounts is not currently an option, and some devices are not managed by Intune.
The SASE client is always enabled, and this access would be limited to devices connected through SASE rather than exposed to the public internet. We also want computer and user logon timestamps in AD to remain useful for identifying inactive accounts and devices. What architecture would securely support machine authentication, group membership updates, and Group Policy processing for remote endpoints?
3 Answers
If the SASE connection is already always on and device-trusted before MFA, I would focus on allowing the minimum AD traffic needed through that connection instead of trying to split the design between KDC Proxy and an RODC. Group Policy normally needs more than Kerberos, including access to SYSVOL and other domain services, so you should validate the complete set of required protocols and restrict them to specific domain controllers.
A machine tunnel also helps with computer logon, policy refresh, and directory activity even when no user is signed in. It can provide a cleaner way to update logon information and group memberships without requiring users to manually start a VPN.
If policy administration can eventually move to cloud management, Intune can apply many settings to hybrid-joined devices and would avoid depending on remote SMB access to SYSVOL. That would not solve every legacy policy or unmanaged-device case, though, so it may only be a gradual migration path rather than an immediate replacement.
A read-only domain controller is not a substitute for a secure path to Active Directory. The endpoint still needs network connectivity to the DC for the machine to authenticate and process Group Policy. KDC Proxy can help with Kerberos authentication, but it does not provide access to SYSVOL, so it will not by itself allow normal Group Policy processing.
Also, authenticating the user is not enough for computer policy. The computer account must be able to authenticate and communicate with a domain controller. The usual design is an always-on, machine-scoped VPN or equivalent device tunnel that starts before user logon and provides the required AD connectivity. Keep that path restricted to managed devices and only the necessary domain controller services rather than publishing an RODC or SMB broadly.
Management wants to keep the policies on-premises for now, and some of the devices are not enrolled in Intune, so a machine-level AD connectivity solution is still needed.