How do domain users logon locally on their workstations? 1

[mask1]

Hi All.

My mobile users logon to a Windows 2003 DC when they are connected to the network. However, then they are at home, they can not log on locally?

Any help whould be appreciated.

 

[compuveg]

Well, you could turn on the user profile caching, but that's not recommended in a high security environment. At least I've heard that works.

The best choice, and what I do, is to create a machine local account for them that's got a different password. They can log into that when away from the domain.

 

[mask1]

Hi compuveg

Thanks for your reply. The problem I am having is that when I join the computer to the DC and create the local account on the computer, after the restart, the local account is not found. My feeling is that I have a group policy that is causing conflicts. I am using Restricted Accounts policy to add the DC accounts to the Local Administrators group in the Workstations.

Do you think this could be the problem?

I look forward to your reply.

 

[PoliMalaka]

Does this GPO delete other accounts on the box, even local ones?

For ease of use you can map any account to look at any profile as long as the perms are correct.
HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Profilelist
Find the SID of the user you want to change and then change the key for ProfileImagePath to point to the correct profile.

 

[jonhowe]

Its quite common to use local profiles rather than roaming profiles for laptops but you lose central control of the profile. Security-wise when off-site you are reliant on NTFS permissions and NT logon security but for most situations its adequate.

It will however allow logging on off the network.

Jonathan

 

[compuveg]

Well, unless your laptop is a DC or the account's been removed by a domain admin, it should have a local administrator account. When you login to the machine, make sure you're logging into the computer, and not the domain. (I'm sure it can be configured so you can't do this) Then create the local account.

To choose where you're logging into, hit the 'Options' button, which should have a 'log onto' drop-down list. This isn't as straightforward if you're using the Novell clients. There you've got to choose 'workstation only', then you've got to hit 'advanced' and goto the windows tab, and there's the 'log on to' drop-down list.

Sure, a domain admin can create a machine local account, but logging in 'machine only' ensures that the ability to do this is there.

 

[porkchopexpress]

If you are using restricted groups then you will need to specify all acconts that you want to appear in the local group or they will be remeoved.

http://www.microsoft.com/resources/...all/proddocs/en-us/sag_scerestrictgroups.mspx

 

[compuveg]

Thanks for the tip PorkChopExpress. That URL is a good bit of info.

 

[mask1]

Hi porkchopexpress

I have addedd the groups that the users belong to to the members of section of the retisted policy object. Is it possible that this is the problem? Do I have to add the user itself?

Thanks.

 

[porkchopexpress]

No you can add groups i do.

If i remember correctly you have to manually type the name of the local group that you want to affect. Have a look at the link below.

http://www.computerperformance.co.u...group.htm#Understanding_Members_and_MemberOf_

 

[mask1]

thanks for th elonk, I have to check how the restricted group policy was implremented. The local accoutns are being deleted when the group policy is applied. So there's got to be something wrong in how the restricted group was created.

 

[porkchopexpress]

You will have to type in the names of the local accounts manually or they will be removed, including the administrator.

 

[porkchopexpress]

E.G.

Administrators: Administrator, Domain\Group1, User1, User2

Power Users: User3, User4, Domain\Group2

The users without a domain name in front are local users, i don't think you can browse for them in active directory so you have to type them in exactly.

 

[mask1]

I will make the changes and let you know, but I have a feeling this will do the trick. Thanks.