Basically I got started looking into this because I got tired of just selecting stuff like NETWORKSERVICE just to make things magically work across our network, and wanted to learn more about what is actually happening. I opened a can of worms and now I really want to figure this out as best as I can, without bothering my network administrators with my stupid newbie questions. Obviously that's what will get me the best answers, but I'd like your guys help in understanding our environment as best as I can first, before I go and get the full story.
Basically, we have about 30 PC's all using Windows 7, and we're all on the same network. We are NOT using Active Directory and apparently this isn't an option (internal history/politics reasons...) When I open My Computer and hit Network, I can see them all.
In order to double click a PC and view it's shared contents, I either have to... 1) go to that PC and create a user account on that PC that is the same name and password as the account I use on my PC or 2) log in as Administrator.
For convenience sake, on the systems we need to access most, we have manually gone in and created individual user accounts for each person on each machine, using the same username as their main workstation PC.
Now, the reason I need to fully understand this system that we have set up, is that I need to know how this kind of networking system is going to work with an internal ASP.NET site running on an IIS 7.0 web server, backed by SQL Server 2008 R2. Since all of our computers have a universal administrator account, it would be easy as pie to just slap on impersonation as Administrator to the web.config file and call it a day, but I really don't want to do that --- I want to do this "right," I want to do this "securely," I want to do this with allowing as least permissions as possible to every user.
Does this really mean that I'm going to have to create Windows Authentication logins for everyone on our SQL Server AND our web server? The site itself should only ever be read-only, period, so I'm thinking I could create a new user account on the web server machine, restrict access to everything but the website as Read Only, and then impersonate that user in the web.config file. But the SQL database, for some groups of people, it should be read-only, for some groups of people, they should have write access as well, but no one should ever have delete access.
The reason I'm having a hard time researching this on my own is that, apparently we're not doing this the "right" way to begin with. Every book I pick up on Windows networking either talks about small home networks, or it jumps to Active Directory for enterprises and large networks.