Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to use my home computer on the work domain some of the time? I would like it have my computer normally run on just my local network and not be part of the domain.

The computer can VPN and I currently remote into my work desktop to get some things done (programming related). I would like to work directly on my machine to take advantage of the better response time, more powerful machine and additional monitors (4 total).

Edit: I know I have to run it by the proper people at the business. This is more of a technical question asking how I should accomplish it instead of whether I should. Thanks for making sure I knew about that part.

share|improve this question
4  
are you running Windows XP Pro? –  Matt Jun 30 '09 at 17:22
    
What VPN client are you using? –  GregD Jun 30 '09 at 17:23
    
Have you talked to your system administrator about adding your (potentially risky) home computer to your work's domain? If you are the system admin.. do you think really this is wise? –  romandas Jun 30 '09 at 17:38
    
Using XP Pro. Cisco VPN. I am not the system Admin, but have briefly talked to help desk about it. –  BenMaddox Jun 30 '09 at 17:49
    
Several promising answers so far. I'll have to verify that I should do this then test some of the answers provided. –  BenMaddox Jun 30 '09 at 18:11

7 Answers 7

up vote 4 down vote accepted

Assuming you're actually authorized to do what you're trying to do, I recommend the strategy as others have suggested of using your VPN client and then "connecting" to servers with manually-specified credentials.

Your machine doesn't have to be "joined" to the domain in order to authenticate to servers that are members of the domain. The technique I describe below is commonly what I do when authenticating my laptop computer to servers at various Customer sites. My laptop computer isn't a member of any of their domains, so I have to manually provide credentials to each server computer in their network that I want to communicate with using Microsoft file and print sharing.

You can do this with the GUI, but I've had horrible luck getting Windows XP to behave in a consistent manner with respect to providing credentials in the GUI. I'd highly recommend doing the following command from a command-prompt before you access a given server from your non-domain member PC:

NET USE \\SERVER-NAME\IPC$ /USER:DOMAIN\username password

Substitute in the name of the server you're accessing, your domain's name, and your usenrame and password. After you do this, Windows Explorer will let you navigate to the server computer w/o prompting for credentials (or timing out, taking wild amounts of time to display results, not prompting and just saying "access denied", etc).

When you're ready to disconnect, do a:

NET USE \\SERVER-NAME\IPC$ /DELETE

And WinXP will "forget" the credentials you've specified.

This is a good technique to know. I'm surprised how many people don't know how to do it (and are sysadmins!).


One other trick that you can do (which I refer to as "poor man's workstation trust relationship") is to create an account on your home computer (or rename and reset the password on the account you already use) with the same username and password as your work domain account. When you connect with the Cisco VPN client you will find that you are able to access work domain controller computers without any of the "NET USE" gyrations I describe above. This is because Windows will transparently attempt to authenticate with the username and password you're logged-on with. Authentication to member server computers can be problematic, and you may find that you have to go the route with "NET USE" that I describe above.


Whatever you do, be sure your IT department wants you doing this before you do it, please! >smile<

share|improve this answer

As Jack has touched on - VPN in, and then manually provide credentials to the resources you wish to access as and when you try to access them (shares, exchange, etc)

share|improve this answer

Based on your response to comments, you can set up your Cisco VPN client to logon to the VPN prior to logging onto your computer. Then, because you're using XP Pro, you can logon to the domain after you've connected via VPN.

One caveat is that your Sys Admin will have to add your computer to the domain as you probably lack the credentials to do that.

After all of that, it will be like your computer is sitting on the lan.

share|improve this answer

Setting your "workgroup name" to the domain name and then logging in to the servers either manually or via Evan Anderson's method (NET USE ...) will get you 90% of the way there. The thing it won't get you is your roaming profile.

share|improve this answer

The Windows VPN client will allow domain authentication. I would advise connecting through the VPN and then working on your home desktop.

If you join your home computer to the domain, you will require an active connection to your work. This is a problem on the login screen, because you typically haven't established a VPN connection before getting to the desktop.

share|improve this answer
    
Not necessarily - Windows will cache the users credentials and allow login if a DC is not available, so long as the user has logged into that machine (from scratch) at least once before whilst connected to a domain. Either way - what he's proposing isn't really possible the way he would like it. –  Izzy Jun 30 '09 at 17:26
    
How does he do the initial scratch login to the domain, since upon joining he will have to reboot, and it will take him to the login screen. –  Jack B Nimble Jun 30 '09 at 17:36

Ask for a domain-joined computer from the company pre-set up and authorized with the policies needed for this to work. If I was the IT manager and someone even mentioned the thought of plugging anything but the company machines into the local network, even more so joining the domain, I would take it as a bad joke and walk away. Seriously ^^

share|improve this answer

Yeah, you can do this, but DO talk to your admins first. They will be colossally unhappy with you if you're caught in the act without checking in with them. What you want from it seems reasonable enough to me, but these people have a network with lots of other users besides you, it's part of their job to ensure nothing nasty or evil gets onto it. If you do this you can be certain other people will also want to do it. Next thing you know is that someone brings in a laptop that their 14 year old son uses at home for a bit of the old wink-wink-nudge-nudge-know-what-I-mean.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.