This message was deleted.

I am wondering. What the use case is for domain joined machines in DMZ?

Application needs a network connection to a third party provider (public sector)

When I was public sector, we had a partner domain in DMZ that had one-way trust to internal. Any use?

I think that's too much for one application

What about a read only DC placed in DMZ and using native IPsec point to point functionality of Windows advanced firewall between read only DC in DMZ and one internal read write DC? With that scenario you only need IPsec ports unlocking in the firewall from DMZ to internal. No high ports. Is that an option?

Sounds good to me, thanks a lot.