Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am interested in providing access for remote desktop, printer shares etc for a non domain machine used for development.

It is internal to the network and fully secured, the user also has a domain account to reference. The stumbling block appears to me (by appears, I accept that this may not be the case!) to be that the computer is not registered as a location within the domain and so any attempts by it to connect or interact do not appear to work - even when providing a domain level account.

Similar questions I have found seem to just focus on shares, I am however more interested in remote desktop abilities.

Does anyone have any pointers or experience with this?

share|improve this question
obvious question, why can it not be on the domain ? – Sirex Sep 22 '11 at 8:29
Its a developers personal machine purely for development but used in other environments too – Draineh Sep 22 '11 at 8:34

In general, there is not much trouble for non-domain-joined clients accessing domain resources. Some things will not work (like domain references for Dfs or site-awareness features for certain protocols), but mostly references to SMB shares are not a problem. TS logons do not depend on domain memberships at all. I am regularily managing our client's domains from a machine that is not a domain member - a task which includes accessing remote file shares and printers, Dfs links, RPC services like remote registry, MMC management consoles or remote command lines - and of course RDP / TS sessions.

When providing authentication, your developer should specify the domain name along with his user name - typically in the DOMAINNAME\username notation. For everything that relies on "internal" authentication it is helpful to establish a SMB connection to a share using the correct credentials first, all subsequent operations connecting to this server (including RPC or even MS SQL server connections) would see the channel pre-authenticated and not require further authentication input from the user.

The developer's machine ideally should be able to resolve your domain's internal DNS names - by having an internal AD DNS specified as its sole DNS server or having set up a redirection / stub zone / slave zone in the DNS server of your developer's network. If name resolution is unavailable, it is possible to work with IP addresses or entries in the machine's "hosts" and "lmhosts" files, but this is obviously somewhat tiresome and links containing names may break.

share|improve this answer
The dev machine is using the DHCP server provided by the AD and as such is using the DNS and IP ranges used by the internal network. It cannot however connect to any machines via remote desktop when providing the correct authentication details (with the domain included with the username) – Draineh Sep 22 '11 at 9:40
I suspect that this would not be an authentication problem. You could use the PrtQuery utility to see if the destination's 3389/tcp port is accessible from the dev's machine. Also, checking the "security" log of your TS might give you some insights - by default it should log authentication failures. You also should check if your terminal servers do not reject connections from clients without "network level authentication" - check the RDP protocol's properties for that. – the-wabbit Sep 22 '11 at 10:07
@Draineh: Define what you mean when you say it cannot connect. How are you trying to connect? What type of resource are you trying to connect to? What happens when you connect? What message,if any, do you get when trying to connect? Give us a single example, with details, such as what happens when you try to connect via RDP to a domain computer. How are you authenticating to that computer? As syneticon-dj stated, RDP access isn't dependent on domain membership. – joeqwerty Sep 22 '11 at 13:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.