Windows Server Roles

Hi all,
I'm planning in migrating some servers to VM's for separate some roles =
and for and replace some old servers. Currently we have 2 domain =
controllers, one on Windows 2000 and other in Windows 2003. Windows 2000 =
is the primary domain controller and W2K3 is Domain Controller, Terminal =
Services, and DHCP (and of course DNS for AD), and I want add VPN server =
for remote access. I have found that is not recommended to run DHCP or =
Terminal services in a Domain controller,  so  I want separate those =
roles to VM's but I want to know which of this roles can I run together =
in a VM without affecting security.

Please let me know your opinions about this.

Thank you and Best Regards,
Alberto Medina=20