Basic Windows networking questions

Question

Basically I got started looking into this because I got tired of just selecting stuff like NETWORKSERVICE just to make things magically work across our network, and wanted to learn more about what is actually happening. I opened a can of worms and now I really want to figure this out as best as I can, without bothering my network administrators with my stupid newbie questions. Obviously that's what will get me the best answers, but I'd like your guys help in understanding our environment as best as I can first, before I go and get the full story.

Basically, we have about 30 PC's all using Windows 7, and we're all on the same network. We are NOT using Active Directory and apparently this isn't an option (internal history/politics reasons...) When I open My Computer and hit Network, I can see them all.

In order to double click a PC and view it's shared contents, I either have to... 1) go to that PC and create a user account on that PC that is the same name and password as the account I use on my PC or 2) log in as Administrator.

For convenience sake, on the systems we need to access most, we have manually gone in and created individual user accounts for each person on each machine, using the same username as their main workstation PC.

Now, the reason I need to fully understand this system that we have set up, is that I need to know how this kind of networking system is going to work with an internal ASP.NET site running on an IIS 7.0 web server, backed by SQL Server 2008 R2. Since all of our computers have a universal administrator account, it would be easy as pie to just slap on impersonation as Administrator to the web.config file and call it a day, but I really don't want to do that --- I want to do this "right," I want to do this "securely," I want to do this with allowing as least permissions as possible to every user.

Does this really mean that I'm going to have to create Windows Authentication logins for everyone on our SQL Server AND our web server? The site itself should only ever be read-only, period, so I'm thinking I could create a new user account on the web server machine, restrict access to everything but the website as Read Only, and then impersonate that user in the web.config file. But the SQL database, for some groups of people, it should be read-only, for some groups of people, they should have write access as well, but no one should ever have delete access.

The reason I'm having a hard time researching this on my own is that, apparently we're not doing this the "right" way to begin with. Every book I pick up on Windows networking either talks about small home networks, or it jumps to Active Directory for enterprises and large networks.

Answer 1

Microsoft's solution for sharing credentials between difference machines is to use an Active Directory domain. Active Directory uses the Kerberos authentication protocol to arbitrate access to resources distributed across different computers from a central authentication database.

What you've done w/ creating user accounts on individual computers is colloquially referred to as the "poor man's trust relationship". By creating these accounts that "mirror" the credentials used on users' "main" computers you've created something that, while not very scalable or manageable (and, frankly, not very secure), will give you a functional similarity to an Active Directory domain for interactive users. For "pass through" (also known as "delegated) authentication, like with your web application and the SQL Server back-ending it, though, you're not going to be able to just create "mirror" accounts to get the functionality you're looking for.

Without Active Directory your only option, as I see it, to having different groups of users authenticate differently to the SQL Server via the web application is going to be storing credentials inside the web application for different SQL Server users and using the appropriate credential to access the SQL Server based on who has authenticated to the web server.