Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a few laptops here that need to have some users profiles preloaded onto them before sending them out in the field so that they can log into them without needing to be connected to the domain controller. I have done some research on Spiceworks and some Google'ing with no luck.

Is there a way to initialize these accounts on the laptops so that when they go out in the field they are able to login? I do not want to ask all the users to log into each laptop once as that is an inconvenience.

The laptops are all running Windows 7 Professional x64 and the domain controller is on a Windows Server 2008 x64 SP2 server.

share|improve this question

4 Answers 4

you could manually use the "run as another use" feature while the laptop is connected to the domain.

This will cache the user credentials on the laptop allowing logon without access to a domain controller.

right click on a shortcut (e.g. calculator) select logon as different user supply credentials.

et voila!

share|improve this answer
    
This still requires user intervention as they will need to input their credentials on each laptop. –  qroberts Mar 4 at 19:16

This is not possible using any supported methods. However:

  • you can provision the profile, it's just a directory, and a registry key structure under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList. Both are easily copied from a machine they've already logged into. You can also use the Default user profile directory if you don't have one already. Be sure to check permissions on the directory when you're done copying.

  • Their password is a hash stored in a registry entry in HKEY_LOCAL_MACHINE\SECURITY\Cache. This can again by copied from a machine they've logged into already. You'll need the psexec utility from the SysInternals suite; run psexec -i -s -d regedit or you wont be able to access the SECURITY hive of the registry.

    Also, there may be multiple keys cached in that directory. I'd generically suggest either pulling the hash from a machine where the user is the only person to log-on, or a limited set of users; or using a cracking program to identify which hash belongs to the user in question. I wont provide any more detail on the latter method, as it should be easy to find information on the Internet.

share|improve this answer

so that they can log into them without needing to be connected to the domain controller.

Typically, you'd configure a VPN on the notebook that runs as a service, so that the remote laptop establishes a VPN connection before the user logs in, so that when they type their credentials in, they are able to authenticate.

share|improve this answer
    
Unfortunately we do not have a VPN. Good suggestion though! –  qroberts Sep 7 '12 at 18:08
    
@qroberts How are you planning on managing these remote laptops after deployment without a VPN? If you don't plan on managing them at all, why bother joining them to AD in the first place, just create a local account. –  MDMarra Sep 7 '12 at 18:11
    
They aren't going to be permanently remote. We have accounting students who are going to write an exam for their designation and I am deploying a bunch of spare laptops for them to use in case their primaries crap out. I have preloaded my support account on the laptops (I am comfortable with giving it out as it has no access other than being able to login) but I'd prefer if they used their own accounts. Also, they will not have any internet access while they are at the exam centre. –  qroberts Sep 7 '12 at 18:14

this is not possible using any microsoft supported methods.

share|improve this answer
    
I tried using runas in command prompt and throwing some switches in there but no luck. EDIT: If the users were all in the office right now I would get them to connect via remote desktop to the laptops and initialize that way but that's not an option. –  qroberts Sep 7 '12 at 18:01
    
Runas won't work because you need their password, which if you had you could just log in as them. Again, there is no supported way to do this. Usually I would say to keep looking because someone somewhere will figure out a way to do this. However, this is one of those edge cases where you are just wasting your time. Give up on this path. Your time is better spent in other solutions. You will not be able to pre load their domain accounts. –  longneck Sep 7 '12 at 21:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.