A Desktop-as-a-Service (DaaS) System running on a cloud computing facility is described that provides a directory service, and that can interoperate with an associated controlled access infrastructure system running on a corporate LAN, the DaaS System comprising: an interface to a zero-trust connection between the DaaS System and the controlled access infrastructure system, a virtual room comprising a plurality of virtual desktops, a first directory service domain controller for implementing and managing a group policy that can be applied to the virtual desktops, and a zero-trust access module for implementing the zero-trust connection. The virtual room runs in a virtual machine or container installed on the cloud computing facility, and directory services (including group policies) for that virtual room can be provided by the domain controller without requiring access to any resource in the controlled access infrastructure system.