1

I am pretty much new to Windows servers.

What I want to achieve:

  1. Allow the users to login using central credential from any on the Client PCs within LAN/WLAN.
  2. They don't get access to the server's desktop even with their valid credentials. This should be just for authentication at client PCs.
  3. They should have a private folder located on the server to which they can save their personal files.
  4. This private folder should get auto-mounted (with drive letter) on the PC where they login.
    I read about the Shared home folder, but I'm preferring a different folder without a system wide importance such as user home directory.
  5. (optional) There should be an option to keep their files on the local system instead of the server share (#2, #3 above) if they want to.

Reading around the techNet manuals and various SO answers, I got a hint that Active Directory can be of use for my purpose. But I am unsure about which Server version I should use, and how would I setup the entire system. Do I need any additional tools to set this up.

Is that all possible to achieve these without making any special setting on the client PCs? I mean just by setting up the server in some particular way!

This (How to "batch" create folders for Active Directory users' network drive?) appears like closer to my needs, but I'm not able to fully understand this.
Apparently it needs the mount script to be run on client PC at login, which I less prefer.


Curiously, I'd like to know whether this setup is possible without using a Server OS at all. For instance, Windows 8.1 Desktop version with few additional Windows tools installed.

  • I'd like to know whether this setup is possible without using a Server OS at all. - No it isn't. – joeqwerty Oct 30 '15 at 21:40
  • AD does allow you to have centralized authentication across all of the domain joined computers. I might suggest you look into using Folder Redirection for the Documents folder instead of using a mapped drive. – joeqwerty Oct 30 '15 at 21:41
  • 1.) Yes, with AD and a SERVER domain controller. 2.) Yes, with AD domain-joined PC and their AD user account credential 3.) Yes, with NET USE mapped drive login script, GGP policies, or AD home directory pointer per AD account 4.) Same as #3 many ways to get this result, pick one 5.) Yes, they can still save on client OS drive locations.... You will need a server for your domain controller, your client PCs need joined to the domain, and the domain Group Policies, AD user accounts, etc. all need defined... you will need to do some work and testing to build this from the ground up. Good Luck! – Pimp Juice IT Oct 31 '15 at 1:49
1

How many users? I ask because of the private folders, and this mainly because it might be tedious to set them up if you have a lot of users (although you might be able to script this).

  1. Set up Active Directory on a Server version of Windows (emphasis because of your question about running this whole thing on workstation OSes). By default, workstations (as in, a workstation operating system) added to the domain have "domain users" as allowed log on users and "domain admins" as administrators.
  2. By default, servers (as in, a server operating system) added to the domain has domain admins in the administrator group and doesn't allow desktop logins to anyone except administrators or remote desktop users.
  3. It sounds like you just want shares rather than roaming profiles. It's generally discouraged to put shares on domain controllers if you can avoid it, but products like Small Business Server do it and it happens. If you just want shares, create a folder named something like usershares with subfolders named after each user and then share each folder with the user and only the user, and name the share after the username. (For example: d:\usershares\username for a username of username, shared as \\yourserver\username.)
  4. Assign a logon script to the users with something like net use S: \\yourserver\%username% or a PowerShell equivalent.
  5. This is where it sounds like you're saying you don't want roaming profiles.

(As for "Why not?"--It's discouraged because it's preferred that you not add any kind of "attack surface" to your domain controller, and any added service is an attack surface.)

I should probably also add that best practice is to have two domain controllers in case one fails. (Virtualizing would still be putting both eggs in one basket, so I wouldn't recommend that. It would be more administration for no risk reduction.)

0
  1. On Widnows the best will be Active Directory. Computers must be members of domain in Active Directory.
  2. By default on AD (Active Directory) member server Remote Desktop login are allowed only for Domain Admins group.
  3. I am using Distributed file System (DFS), configured namespace for "Home" root location (\\domain.local\home) and set Quota on it.
  4. It can be done by Group Policy. Profile Tab on AD user object properites - you need "copy user" when creating new one or make script if you don't want manually edit this. The last one is NET USE as logon script.

But I am unsure about which Server version I should use, and how would I setup the entire system.

Windows Server 2012 R2 Standard. One for Domain Controller, one for storage server with home directories. Both on separate physical machines.

Moreover you need CAL licenses for each user OR device connecting to Active Directory. CAL per user/CAL per device.

Is that all possible to achieve these without making any special setting on the client PCs?

PC's must have at least Windows Professional edition (XP,7,Vista,8,8.1,10). You need only add PC to Active Directory.

  • Why separate physical machines? One for Domain Controller, one for storage server with home directories. Can't they both be on same server machine? – Izhar Aazmi Oct 31 '15 at 16:36
  • Well, they can but it is very risky to whole AD. If you want to do this on one machine - virtualize it. One license allows you to run two virtual instances of Windows Server 2012 R2 Standard on one machine with two physical processors. – ADPien Oct 31 '15 at 17:45
  • Can you please explain or better link to what exactly the risk is? – Izhar Aazmi Oct 31 '15 at 18:16
  • Server load, Domain Controller policy applied on file server, possible infected files on the same disk space. – ADPien Aug 4 '16 at 10:01
0

You could use "Work Folders" on Windows Server 2012 R2. This allows any Windows 7 and above machines (not domain joined) to mount a private folder on the server. You only need to create the accounts on the AD and then generate a SSL certificate. The clients PC can then access the share using the account you have created in AD.

However it might not meet your Requirement 4 as it doesn't map using drive letter.

Source: https://technet.microsoft.com/en-us/library/dn265974.aspx?f=255&MSPPError=-2147217396

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.