In the Administering Windows Server Hybrid Core Infrastructure guidance for "Implement and manage AD DS sites and replication," Microsoft explains that client computers are site-aware and "select domain controllers in their own site whenever possible." A client's site membership is determined solely by the mapping of its IP subnet to an AD DS site. The material further notes that administrators should "create subnet objects and associate them to the appropriate site so that clients resolve and authenticate to DCs in that site; if a subnet is not mapped, clients may use any reachable site through site coverage." By creating a new subnet object for the branch office and associating it with Site1, all clients in that subnet will treat Site1 as their site and will therefore query and authenticate primarily against Site1's domain controllers, only failing over to other sites if necessary via DEFAULTIPSITELINK. This meets the stated goal without requiring domain controllers in the new office, because site affinity controls the preferred DC selection for Kerberos
/NTLM authentication and LDAP/GC queries.