Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to improve our account management (using Active Directory) for a customer support site with 50+ computers.

The default "AD"-way is to give each user their own account. This adds up with a lot of administration with adding/disabling/enabling user accounts.

To avoid this supervisors have started to use shared "general" accounts like domain\callcenter2 etc and I don't like the idea of everyone knowing and sharing accounts and passwords.

Our ideal solution would be to create a group with computers which requires no login by the user. I.e. the users just have to start the computer.

  • Should I configure auto-logon with a single user account like domain\agentAccount?
  • Is there anything else to consider if I use the same account for all users?
  • How do I configure the actual auto-logon with a GPO on the group? Is there a "Microsoft way" without 3rd party plugins?

Or is there a better solution?

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

You can configure autologon on a computer by computer basis by setting the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName (E.g. DOMAIN\USERNAME)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword Password in plain text

You could configure this using Group Policy Preferences. However, there are two clear security risks - firstly, the plain text password and secondly, as have an automatic login you may aswell just let everyone have the passwords.

There are a couple of technical issues with sharing user accounts, such as user customisations, profiles etc. However, the biggest problem will be accountability.

To me, this feels like a classic case of using technology to solve a social issue. You need to go up your chain of command and design an Acceptable Use Policy that stipulates:

  • All users must use their own user account
  • No user should ever disclose their password
  • Users must log off, or lock their workstation when not in use

Every other company manages to get people to use their own user account and password, and you should be no different.

share|improve this answer
    
Thanks! I totally agree with you about this being a social issue. But technically, let's say we install 5 computers in our reception for guests to use while waiting for someone. How do I keep them logged in at all times? –  Jonas Stensved Oct 23 '12 at 10:07
    
@JonasStensved Fair question and the above registry keys will work great. In the event of a log off, they'll just log straight back on unless you hold shift. –  Dan Oct 23 '12 at 10:13
add comment

We have moved from registry autologons to Logonexpert's tool ones. Just deployed it over network via GPO and configured each workstation via logon script

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.