Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If we are running a server that is not attached to the domain, how would I go about adding a domain user to a local group on that server?

share|improve this question
up vote 11 down vote accepted

You don't. There has to be a trust between the computer and the domain (aka joining the computer to the domain) to be able to authenticate domain users locally.

Now for something practical:

You have two options 1) create a local user with the same username and password as the domain user, and add that local user to the local group. 2) Join the machine to the domain.

share|improve this answer
So simply adding a local user with the same name and password is sufficient to create trust (in this instance)? – Michael Todd May 25 '10 at 19:44
It's not so much creating a trust as having your username and ntlm hash match ... it's more of a hacky work around than anything really. – Zypher May 25 '10 at 19:47
Correct. The domain user tries to connect, Kerberos won't be tried, so unless you have GPOs that prevent clients from trying to authenticate via down-level protocols, the machine will try NTLM. If they match, then you're in without having to type anything. – mfinni May 25 '10 at 19:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.