Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If we are running a server that is not attached to the domain, how would I go about adding a domain user to a local group on that server?

share|improve this question

1 Answer 1

up vote 7 down vote accepted

You don't. There has to be a trust between the computer and the domain (aka joining the computer to the domain) to be able to authenticate domain users locally.

Now for something practical:

You have two options 1) create a local user with the same username and password as the domain user, and add that local user to the local group. 2) Join the machine to the domain.

share|improve this answer
    
So simply adding a local user with the same name and password is sufficient to create trust (in this instance)? –  Michael Todd May 25 '10 at 19:44
1  
It's not so much creating a trust as having your username and ntlm hash match ... it's more of a hacky work around than anything really. –  Zypher May 25 '10 at 19:47
1  
Correct. The domain user tries to connect, Kerberos won't be tried, so unless you have GPOs that prevent clients from trying to authenticate via down-level protocols, the machine will try NTLM. If they match, then you're in without having to type anything. –  mfinni May 25 '10 at 19:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.