[Samba] Active Directory clients in DMZ

[shacky]

> Microsoft has a doc for this, but being microsoft they don't call it a
> DMZ, it's a 'perimeter network'
>

Thank you for your answer.
I read the Microsoft's document and now I know about a Read Only Domain
Controller (RODC).
This could be deployed in the DMZ (I need two of them for high
availability) and after that I will be able to join clients and
applications on DMZ too.
But... What about simply adding two additional domain controllers in the
DMZ securing the access between them on the perimetral firewalls?

What do you think about?
Have you ever deployed something like this before?