Help with W2K Professional Clients in a WINNT Domain. 1

[Maritime]

I run Windows NT with mostly Windows 95/98 clients. With Win95/98 these client PC's were configured to be part of a workgroup (dept name)and log on to an NT Domain. This way when you browse the Network, you see each department in a seperate group, and this way it's easy for PC's to be found on the network. Now I've started intoducing W2K prof. PC's to the network and they can either be part of a workgroup or Domain, not both. In order to keep my current design I put the W2K PC's in workgroups. The prpblem with this however is finding a way to synchronize the local passwords with the NT server passwords. Each time a user changes their password, I have to manually make the change on the server. If this is not done the user losses access to the NT Servers that run services like Mail. I am wondering, is there any way or tool that can be uses to synchronise these passwords, other than me adding all w2k computers to the domain and having one huge list of pc's displayed in network neighbourhood? I know that w2k server uses Active Directory to place PC's in groups but I'm not running a W2k server.

Thanks in advance.

 

[wolluf]

I think you may have to make them domain members to keep your admin work down! You can always give their PC a description which includes workgroup name they should be.

Only alternative I can think of is not very secure (short of getting a programmer to write you an app to do this). Basically provide a batch file which will prompt user for new password (they have to use this rather than normal password change mechanim). Batch file will then run net user to update local machine & submit a job to run net user on the server. You can do this with something like psexec (part of pstools freeware from

http://www.sysinternals.com)

- but you'd need to include username/password of domain user with authority to do this in the batch file.

 

[Maritime]

Hi Wolluf,
Thanks a lot. I was really hoping there was a workaround, but as you said, although the batch file works, the security is an issue. But you've given enough information to move on.

Thanks again.

 

[mbaldwin]

I would forget about the workgroup and put all your PCs in the domain. All users use thier domain accounts and you don't have to concern yourself with local accounts. All admin work is done a one central point.

Establish a PC naming convention and change the PC names IE.(1GROUP001, 1GROUP002, 2GROUP001, 2GROUP002, etc.).You can visually seperate them based on thier PC name when viewed on the network.

Using the domain only will save allot of time...