Can branch PCs join an HQ Active Directory domain over a site-to-site VPN?

Yes, this is a common design for smaller branches. If the branch has reliable connectivity to HQ, its PCs can use the central domain controllers without a local server. The tradeoff is that logons and domain-related services depend on the VPN and the HQ connection being available.

Make sure the branch clients use the domain DNS service, and configure the Active Directory sites and subnets to reflect the actual locations. That helps clients find the right domain services. For a lab, joining a PC across the tunnel is a sensible way to test the basics.

The key detail is DNS. A client joining the domain needs to resolve the domain’s service records and reach a domain controller. Point the branch PC at the AD-integrated DNS server across the tunnel, or provide a local DNS server that can resolve the domain correctly.

For firewall rules, don’t assume a single port is enough. AD uses several services, including DNS, Kerberos, LDAP, SMB, RPC endpoint mapping, and dynamic RPC ports. Use the vendor’s documented Active Directory service group as a starting point, then check the relevant Microsoft guidance for your environment and restrict access between the needed subnets rather than opening everything broadly.

It works, but think about what happens when the tunnel or HQ goes down. A branch without a local domain controller may lose access to domain services, and a new machine may not be able to join until connectivity returns. Remote users can also notice latency during logon or policy processing, depending on the connection.

For a small office, central domain services may be a reasonable cost-saving choice. Larger or less-connected sites might justify local domain services. In some environments, cloud-based device management or directory options may fit better, so the right design depends on operational needs.

One practical wrinkle is deployment. Some organizations join and configure PCs centrally before shipping them to small branches, which avoids making the first domain join depend on a remote link. If devices are built at the branch, a working VPN and DNS path are enough in principle, but the connection quality still matters.

Also make sure the HQ and branch networks use distinct IP ranges, and that routing works both ways through the tunnel. Overlapping subnets can turn a straightforward setup into a frustrating one.