6

I have a few laptops here that need to have some users profiles preloaded onto them before sending them out in the field so that they can log into them without needing to be connected to the domain controller. I have done some research on Spiceworks and some Google'ing with no luck.

Is there a way to initialize these accounts on the laptops so that when they go out in the field they are able to login? I do not want to ask all the users to log into each laptop once as that is an inconvenience.

The laptops are all running Windows 7 Professional x64 and the domain controller is on a Windows Server 2008 x64 SP2 server.

4 Answers 4

3

This is not possible using any supported methods. However:

  • you can provision the profile, it's just a directory, and a registry key structure under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList. Both are easily copied from a machine they've already logged into. You can also use the Default user profile directory if you don't have one already. Be sure to check permissions on the directory when you're done copying.

  • Their password is a hash stored in a registry entry in HKEY_LOCAL_MACHINE\SECURITY\Cache. This can again by copied from a machine they've logged into already. You'll need the psexec utility from the SysInternals suite; run psexec -i -s -d regedit or you wont be able to access the SECURITY hive of the registry.

    Also, there may be multiple keys cached in that directory. I'd generically suggest either pulling the hash from a machine where the user is the only person to log-on, or a limited set of users; or using a cracking program to identify which hash belongs to the user in question. I wont provide any more detail on the latter method, as it should be easy to find information on the Internet.

2

so that they can log into them without needing to be connected to the domain controller.

Typically, you'd configure a VPN on the notebook that runs as a service, so that the remote laptop establishes a VPN connection before the user logs in, so that when they type their credentials in, they are able to authenticate.

3
  • Unfortunately we do not have a VPN. Good suggestion though!
    – qroberts
    Sep 7, 2012 at 18:08
  • @qroberts How are you planning on managing these remote laptops after deployment without a VPN? If you don't plan on managing them at all, why bother joining them to AD in the first place, just create a local account.
    – MDMarra
    Sep 7, 2012 at 18:11
  • They aren't going to be permanently remote. We have accounting students who are going to write an exam for their designation and I am deploying a bunch of spare laptops for them to use in case their primaries crap out. I have preloaded my support account on the laptops (I am comfortable with giving it out as it has no access other than being able to login) but I'd prefer if they used their own accounts. Also, they will not have any internet access while they are at the exam centre.
    – qroberts
    Sep 7, 2012 at 18:14
1

this is not possible using any microsoft supported methods.

2
  • I tried using runas in command prompt and throwing some switches in there but no luck. EDIT: If the users were all in the office right now I would get them to connect via remote desktop to the laptops and initialize that way but that's not an option.
    – qroberts
    Sep 7, 2012 at 18:01
  • Runas won't work because you need their password, which if you had you could just log in as them. Again, there is no supported way to do this. Usually I would say to keep looking because someone somewhere will figure out a way to do this. However, this is one of those edge cases where you are just wasting your time. Give up on this path. Your time is better spent in other solutions. You will not be able to pre load their domain accounts.
    – longneck
    Sep 7, 2012 at 21:19
1

you could manually use the "run as another use" feature while the laptop is connected to the domain.

This will cache the user credentials on the laptop allowing logon without access to a domain controller.

right click on a shortcut (e.g. calculator) select logon as different user supply credentials.

et voila!

2
  • This still requires user intervention as they will need to input their credentials on each laptop.
    – qroberts
    Mar 4, 2014 at 19:16
  • granted, although we supplied laptops to a UK law enforcement agency with a default kiosk running as a local user would connect to a limited access VPN and allow a user who had never authenticated on that device before to "runas" their own credentials, starting a simple process like calc before immediately logging off. This user now has cached credentials on the device and can authenticate without a VPN. There were other hoops to jump through to fully participate in an Active Directory domain... but this would at least get the user on and working.
    – Djarid
    May 13, 2021 at 14:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .