Is it possible to authenticate Active Directory over VPN?

Question

Active Directory

Hello! There is a domain on Windows Sever 2012R2. There are about 25 branches. Each branch has 2 - 3 computers. Of course, it is wasteful to install an RODC controller in each branch. But there is an idea to connect all branches via ipsec vpn (site-to-site). It is clear that everything will depend on the stability of the channel, but in principle, has anyone tried to do this? Or maybe you can recommend something? Why was it necessary - I don't want to write policies manually on 60 computers. Thanks in advance.