[Syswatch]

Hello Guys,

When installing a new Win10 machine, its possible to join an AAD domain, and that works great.

But, is it possible to apply Group policies to these Win10 joined computers, without having an on-premise AD ?

 

Thanks.

 

[Advertisements]

to apply active directory controlled group policy, you have to have active directory, which means you have to have a domain. which means you have to have a domain controller

 

whether or not that domain (domain controller) is on premise depends on a lot of things.

 

you can do "off-prem" domain controllers for things like remote sites where there is a WAN connection to the main office where the domain controller resides.

some companies are doing hosted active directory (where AD lives in the cloud).

 

obviously these bring up their own issues (connectivity requirements, bandwidth requirements, etc...)

 

typically for remote sites companies will deploy a read only domain controller that just synchronizes the active directory database from the main domain controller(s) in another facility, that way the computers at the remote location have a physically local domain to authenticate to, but no one at that location can manage the domain

[dsenette]

to apply active directory controlled group policy, you have to have active directory, which means you have to have a domain. which means you have to have a domain controller

 

whether or not that domain (domain controller) is on premise depends on a lot of things.

 

you can do "off-prem" domain controllers for things like remote sites where there is a WAN connection to the main office where the domain controller resides.

some companies are doing hosted active directory (where AD lives in the cloud).

 

obviously these bring up their own issues (connectivity requirements, bandwidth requirements, etc...)

 

typically for remote sites companies will deploy a read only domain controller that just synchronizes the active directory database from the main domain controller(s) in another facility, that way the computers at the remote location have a physically local domain to authenticate to, but no one at that location can manage the domain

[Nemesis-Dinu]

1. No, Azure AD does not have GPO services.
2. Its not offering all the services as OnPremise AD.
3. If you want to have GPO services then better put a OnPremise AD is the only option.