Active Directory Over The Internet, Without Azure AD
Reach your on-prem domain controllers from anywhere over an outbound-only overlay: domain logon, Group Policy and file shares, no hybrid join or cloud sync.
What signing in looks like
What this actually does
Microsoft answers remote Active Directory by moving your identity to Entra. ControlIT answers it by keeping the domain controller yours and making the internet behave like the LAN it already sits on.
Your existing domain controllers stay exactly where they are.
No new forest, no new domain, no trust relationship, and no schema change.
Remote and branch machines reach the directory across an encrypted peer-to-peer fabric, so domain logon, Group Policy processing, and file-share access work the way they do in the office.
Nothing is published to the internet.
Endpoints establish outbound connections, so there is no inbound port, no public IP, and no domain controller sitting in a DMZ.
No Azure AD Connect, no hybrid join, and no forced directory synchronisation. Your user objects and password hashes stay inside your estate.
Single sign-on and TOTP multi-factor authentication run against the same directory identity, so you are not maintaining a second parallel user database.
What changes as a result
- Remote staff under the same directory policy as head office
- No identity migration project just to enable remote work
- No Entra licence line item added to enable remote AD
- A smaller external attack surface than published RDP or a DMZ DC
- Defensible answers for data-localisation and CERT-In questions
Three ways to find out if it fits.
AD Readiness Review
Forty-five minutes on your directory and remote access, and a one-page verdict you can circulate.
Book the reviewThe 14-Day Pilot
Five criteria agreed in writing first, then tested on real endpoints. If it fails, you walk.
Plan a pilotTalk to Us
Tell us about your sites, endpoints and directory. We will tell you what the overlay changes.
Talk to us
Book a 45-minute AD-over-internet review
Bring us your directory, your remote access and your sites. We will map what the overlay changes before anyone signs anything.