Connecting to a domain without internet?

Question

Active Directory

There is a domain.
There are users with laptops who are traveling and can leave with a laptop within 1-3 days.
How to organize correctly authentication in AD for travellers?
There are 2 options:
1) VPN on the router before authentication. (here the question arises, first you need to turn on the PC, connect to the Internet. And the VPN is turned on already when the PC is started, i.e. how will it start without configured access to the world)
2) Option to save the password cache locally (CashedLogonsCount). Passed authentication (locally), chose VPN, connected to the domain network.
I like option 2, why is it bad? What do you advise ?

Answer 1

1. I don’t see the point in answering the first point, sorry. the second covers everything.
2. the essence of the problem is not at all clear. That's how a lot of people work.
laptops are entered into the domain? if so, it means that you have already logged in and the account is cached, which will give you the right to log in N more times. and you don't even need to do anything else. after login, we connected to the domain network, we are working. while also updating the cache. the only condition is to log in at least once before going to the fields. although this can be solved.

Answer 2

I dare to suggest, as an option: Microsoft DirectAccess maybe this is what you need

Answer 3

How about the first option? Travelers will carry a vpn router with them? That is, PC --> VPNclient-->VPNserver+AD. With a cache it's somehow easier. And if VPN with authorization through AD? Immediately two hares.