We're deploying an always-on SASE connection that requires MFA before users can access on-premises resources. I'd like domain-joined endpoints to authenticate to Active Directory and receive computer and user Group Policy updates before the user completes MFA, while exposing as few services and ports as possible.
After MFA, devices will have normal domain controller access. The main concern is that users may not receive updated group memberships until they log out and back in while they have connectivity to a domain controller. Most of our workforce is remote, and some users rarely connect to the VPN today.
A KDC Proxy seems useful for Kerberos authentication through a single exposed service, but it does not provide access to the SYSVOL share over SMB, which is required for normal Group Policy processing. Windows Server also does not currently provide a QUIC-based alternative for SYSVOL.
Could a read-only domain controller serve as the source for Group Policy files while KDC Proxy handles authentication? The environment uses hybrid Active Directory with traditional AD-joined computers and AD-backed user accounts. Moving to Entra-joined devices or Entra-based user accounts is not currently an option, and management wants to keep policies on-premises. Some devices are also not enrolled in Intune.
The SASE connection is always enabled and cannot be disabled. This access would be restricted to managed devices on the private SASE network, not exposed directly to the public internet. We'd also like computer and user sign-in activity to update AD timestamps so we can identify inactive accounts and devices.
4 Answers
Since the devices are hybrid joined, Intune could handle at least some policies without requiring traditional SYSVOL access. That would reduce the amount of AD connectivity needed for remote users, although it would not solve every legacy policy or unmanaged-device case. If management requires on-prem Group Policy and some systems are not enrolled, a machine tunnel remains the more complete solution.
User authentication and computer Group Policy are separate concerns. KDC Proxy may help the user obtain Kerberos authentication, but the computer must independently authenticate and contact a domain controller to process computer policy. A user’s MFA session does not provide the machine with the connectivity it needs. Also, AD logon timestamps are not a perfect activity source in a multi-DC environment, so use them alongside other device-management and authentication data rather than treating them as definitive.
A KDC Proxy only helps with Kerberos communication; it does not replace the SMB access that Group Policy needs for SYSVOL and related domain services. An RODC also is not meant to be placed on the public internet. If remote devices need normal computer-side Group Policy processing, the practical design is an always-on, machine-scoped VPN or private SASE tunnel that gives the device controlled connectivity to a domain controller. The computer—not just the logged-in user—must be able to authenticate and reach the required AD and SYSVOL services.
An RODC could be useful at a properly secured remote site, but it does not eliminate the connectivity and security requirements. You would still need a private route to it and the necessary AD, DNS, Kerberos, LDAP, and SYSVOL traffic. Treating it as a special pre-MFA endpoint for internet-based access would be a risky design. Keep the DC reachable only through the device-level SASE or VPN connection and restrict access to managed machines.
Management wants to keep the policies on-premises, and we still have devices that aren’t enrolled in Intune, so we need to support the traditional AD path for now.