Forum Discussion
Offline Domain Controller - Security Strategy
ianmidg Read all posts above yours, check the links I provided you and you'll find some real reasons why it's a bad practice to do this.
Offline CA root has its own security challenges, but it's not domain-joined, so all the issues related to an offline domain controller doesn't apply there.
Keeping an offline DC is a beautiful idea and you can easily schedule it for updates and limit its replication partners so that it is "isolated" from the rest of the network until you put it into service.
The good news is that when you need it, you won't require backups or any time-wasting measures that stress you out when the users lose their tempers because they can't access your domain or forest resources.
Of course, there are many other ways to restore your domain controllers in the event of total catastrophe, but this is definitely one of the methods you should consider in your DRP strategy and I applaud you for not giving in to nay-sayers because this method works too.
If you want to explore some of the ways to implement the strategy please DM me and I will send you a few different approaches to achieving it with varying degrees of complexity and fault tolerance.
If you keep an open mind and continue being creative in your approach to security you will bend the risk-reward ratio in your favor. Professional interlopers are risk averse and always consider the ratio when they attempt an infrastructure breach.