> But how then does people working from home logon to their AD joined computers? I work in this exact type of environment. Your laptop is joined to the domain

> But how then does people working from home logon to their AD joined computers? I work in this exact type of environment. Your laptop is joined to the domain in office before being sent to you. You can of course logon to the laptop even though it cannot connect to the domain. You just have to connect to the VPN and domain periodically to get gp updates if there is some mandatory software it'll install when you connect. So you connect to the VPN after you logon locally. You also have to connect to the domain to change your password. > Those servers have been exposed to the internet because if they weren't the organizations using them would be forced to solve the chicken and egg problem of how to authenticate the users against an authentication server they cannot access without authentication. No you can logon to a computer with your domain credentials even when it's not connected to the domain.