If we are running a server that is not attached to the domain, how would I go about adding a domain user to a local group on that server?


You don't. There has to be a trust between the computer and the domain (aka joining the computer to the domain) to be able to authenticate domain users locally.

Now for something practical:

You have two options 1) create a local user with the same username and password as the domain user, and add that local user to the local group. 2) Join the machine to the domain.

  • So simply adding a local user with the same name and password is sufficient to create trust (in this instance)? – Michael Todd May 25 '10 at 19:44
  • 1
    It's not so much creating a trust as having your username and ntlm hash match ... it's more of a hacky work around than anything really. – Zypher May 25 '10 at 19:47
  • 1
    Correct. The domain user tries to connect, Kerberos won't be tried, so unless you have GPOs that prevent clients from trying to authenticate via down-level protocols, the machine will try NTLM. If they match, then you're in without having to type anything. – mfinni May 25 '10 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.