Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Question: Can a user log in with domain credentials to a machine not on the domain? What trust relationship needs to be set up to allow this?

The current setup is remote workers log in to their personal home machines as local-workgroup users. Then they run a client to tunnel a VPN. At this point they can browse the servers and authenticate themselves with domain credentials. This setup has its drawbacks such as constant providing of alternate credentials. But it seems to be the best way I know of without requiring their personal machine join the domain.

Another scenerio we are considering is to host a VM on their home machine. That VM will be a member of the domain. I think citrix offers a product that uses this design. I'm worried that there might be some overhead or limitations in the usage of the GPU.

So I'm not sure if i'm asking the question correctly. Basically I want remote workers to have a separate user profile for connecting to work that uses a domain user account (and get the gpo's etc). It has to work with our vpn.

Any ideas?

share|improve this question
I appreciate the alternate solutions but I'm mainly trying to learn more about domains and trust delegation. If we do use a VM hosted locally, we will probably wait until windows8. and remote desktop just won't work unless we get some remoteFX hardware, which again isn't an option currently. – Ben L Jul 25 '12 at 17:06

What you're proposing seems like a fairly unwieldy solution. How do users run LOB applications from their home computers while connected to the company VPN? Do you install the LOB applications on their home computers?

My suggestion would be to use TS/RDS or VDI. The users can connect via VPN, log on to a TS/RDS server or log on to a virtual desktop and run the LOB applications.

share|improve this answer
LOB? Acronyms!! – ewwhite Jul 25 '12 at 16:52
LOB is line-of-business. We have a couple of solutions for installing apps, they would work better if the machine and user was a domain member. Remote desktop isn't an option in this case. I'd like a VDI solution but they are too expensive to get from citrix. – Ben L Jul 25 '12 at 17:01
I wholeheartedly agree; Remote Desktop, VDI, or even Citrix-style published remote apps - while non-trivial to set up and maintain - are much easier to deal with in terms of user configuration and support. – gWaldo Jul 25 '12 at 17:03
Any time you're asking an end-user to deal with a VPN or VM, you're begging for an ulcer. – gWaldo Jul 25 '12 at 17:04
ewwhite: Apologies. Sometimes I revert to corporate speak; LOB, ROI, TCO, etc., etc. – joeqwerty Jul 25 '12 at 17:07

If these home machines are supplied by them, then your demarcation point is the VPN software. I don't think you should be worried about how they log in.

share|improve this answer
The issue is more to do with training and support. We are seeing undefined unpredictable behavior in the various software that we use. Also, we would like the experience to be identical to coming into the office. Most of the workers also have a workstation in the office as well. – Ben L Jul 25 '12 at 16:13
@BenL Have them TS into their workstations. You're just not going to find a magical, cheap solution to make your users personal machines identical to their office ones. – HopelessN00b Jul 26 '12 at 2:23
How many times can I repeat? Remote desktop isn't an option. It doesn't work for us. I'm only looking for something to handle credentials and authentication more smoothly. – Ben L Jul 26 '12 at 15:32

Have you all considered using Logmein remote connection? For Supervisors at work, I have Logmein Pro installed on their workstations. When they are at home (or on the road via their tablets) they login to, find their workstation and access their workstation. We eliminated having to join their personal computer to our domain or having them install a VPN client on their home computer.

If you can't do the above I have done the following in the past with Windows XP home edition. XP Home can't join a domain right? So, I made my home pc's user name and password the same as my work credentials. In my network places, I was able to view and access all of the available shares. I was still "connected" to the domain at work via the VPN software, but I wasn't part of the domain. I don't know if this works with Windows 7 home, but I would think it's doable.

share|improve this answer
Users at home have Windows7 pro or ultimate. Remote desktop isn't a good fit for this scenerio. Most of the applications complain when they are in remote desktop. – Ben L Jul 25 '12 at 17:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.