Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

For some reason, the IT department at our company does not want to add Windows 7 and Windows Vista machine to the domain controller.

I hate to always provide my network credentials everytime I access a shared folder on a machine that is joined to the domain. I also hate to always provide my password when I launch outlook or Visual Studio (Team Explorer).

Is there a way to mimic the behavior of a machine that is added to a domain without actually adding the machine in the domain?

For shares, I can create a batch file that will NET USE the different fileservers we use here but that is a huge security risk as I will type my password as plaintext.

Thanks!

share|improve this question

migrated from superuser.com Nov 25 '09 at 15:24

This question came from our site for computer enthusiasts and power users.

    
There probably is a very good reason why they won't let you add Vista/Win7 computers. A pretty safe bet is that their security policy/package enforcement (like antivirus and such) is built around Windows XP. –  pauska Nov 30 '09 at 15:21

4 Answers 4

Jon was on the right track with Kerberos, but didn't go into specifics.

On the server, you need to create a machine account. Hold on to the password.

You need to map your local account on your box with your account on the domain. From the command line:

ksetup /setrealm YOURDOMAIN.TLD
ksetup /addkdc YOURDOMAIN.TLD yourkdc.yourdomain.tld
ksetup /setmachpassword the-password-from-above
ksetup /mapuser yourdomainaccount@YOURDOMAIN.TLD yourlocalaccount

(the KDC in step two is usually the domain controller)

You can now access all Kerberised services, but your machine has not actually been joined to the domain.

share|improve this answer

what you desire is possible. follow this tutorial

http://codebetter.com/jameskovacs/2009/10/12/tip-how-to-run-programs-as-a-domain-user-from-a-non-domain-computer/

its a beautiful thing. :)

share|improve this answer
    
Linking to the article is good, but you should also summarize it into a meaningful answer. –  Scott Pack Mar 18 '11 at 0:45

A Windows (&Samba potentially) domain will use a single sign on system called Kerberos to authenticate you when you log in. Once you have been granted a Kerberos ticket you can access any "kerberised" service without having to type your username and password again - such as your file server.

You may have some success by ensuring your local Windows account uses the same username and password as your domain account and for instance mapping the network drive. Also you can frequently save your credentials in the applications - but this obviously a potential security issue and as anybody who has ticked Outlook's save password box can tell you it frequently doesn't work.

This may help you to get Oulook to remeber the passsword: MS Technet article

share|improve this answer
    
Creating a local Windows account with the same username and password as my domain account will not work. I have some success with the mapping though. Although I have to provide my credentials and tick the "Remember my password" box first. –  Ian Dec 1 '09 at 16:34

You can also create a batch script that will take the first parameter of the script as your password and pass it to the net use scripts within the batch file.

You could also leave out the password as a parameter and have it prompt you, then add the batch file to your startup items.

My main question would be why the IT Department won't let you join it to the domain? Is it a personal machine? If it is I wouldn't be happy in my office for it to be even connected to the physical network never mind the domain.

share|improve this answer
    
They said that they haven't fully tested connecting Vista and Win7 machines to the domain. –  Ian Dec 1 '09 at 16:33
2  
That is such a cop out! Vista's been out, what, 2 years? –  Dan Dec 2 '09 at 12:28
    
(Over) three years for vista, but skipping over it isn't too stupid. –  LapTop006 Jan 3 '10 at 12:49
2  
Nice excuse, but probably not quite true, they're probably still running mixed mode with Windows 2000 domains, which doesn't quite allow Windows 7 machines (and maybe even Windows Vista) machines to join –  baldy Jan 6 '10 at 12:20
    
Ah, that is a completely valid point! It's been a while since I've seen a Windows 2000 mixed domain. –  Dan Jan 6 '10 at 16:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.