up vote 1 down vote favorite
share [g+] share [fb]

If we are running a server that is not attached to the domain, how would I go about adding a domain user to a local group on that server?

link|improve this question
feedback

1 Answer

up vote 6 down vote accepted

You don't. There has to be a trust between the computer and the domain (aka joining the computer to the domain) to be able to authenticate domain users locally.

Now for something practical:

You have two options 1) create a local user with the same username and password as the domain user, and add that local user to the local group. 2) Join the machine to the domain.

link|improve this answer
So simply adding a local user with the same name and password is sufficient to create trust (in this instance)? – Michael Todd May 25 '10 at 19:44
1  
It's not so much creating a trust as having your username and ntlm hash match ... it's more of a hacky work around than anything really. – Zypher♦ May 25 '10 at 19:47
1  
Correct. The domain user tries to connect, Kerberos won't be tried, so unless you have GPOs that prevent clients from trying to authenticate via down-level protocols, the machine will try NTLM. If they match, then you're in without having to type anything. – mfinni May 25 '10 at 19:51
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.