Group policy vs. Local group policy: which is correct for this use case?

Question

Quick background: I've been working with group policy since Win2k; I'm in an organization that's just getting around to rolling out Active Directory. I've got a few cases where I need to provide access to a desktop session and a few applications on a descent number of workstations (~40). The users won't be individuals who have managed AD accounts in our domain. I've mocked up a very restrictive computer and user policy (not local group policies), and want to apply to these ~40 workstations. I'll have a few different user accounts that can only login to a subset of these devices. For argument's sake, let's say 4 users that can logon to 10 unique workstations each. The password will be known to the staff that support these devices.

I've done this many times in the past by creating similar restrictive policies. These logins don't have any privileges outside of the local devices that they're logging into, which is enforced by policy.

I've gotten into a spirited discussion and the other end of the discussion is telling me that I should use local accounts and local group policy on each of these devices instead of using domain accounts (with most privileges revoked) and domain policy applied to respective OU's and filtered by domain groups.

It's considerably less efficient for me to write some sort of script to copy local group policy objects. I don't get access to all of the settings that domain policy gives me, and I then have to "manage" local user accounts and passwords on all of these devices.

I'm being told that the reason I should go this direction is because the domain user accounts are "more risky" than the local accounts because they aren't local accounts. My argument is that with proper policy application, both instances present the same risk -- that someone can login to those machines and get a deskop/access to applications -- which is actually the requirement, so the articulation of risk is exactly my requirement. It is a known risk that I must take to fill the requirement -- regardless of which way I accomplish it.

What am I missing? I've done this many times, but I'm being told that I'm wrong without any articulation of what I'm doing wrong. I'm just being told to do it with local accounts and policies.

Should I ever use local group policy to do anything that I can accomplish with group policy?

Thanks for any insights and experiences you can provide to backup/refute my assertions.

Answer 1

The answer can be complicated:

1. Security wise I would always prefer domain vs local policies, it also gives you a certain control for them
2. You said that the users are local and they will not be in domain. Anyway I would prefer to have everything centralized but I can see why someone would do that - non connected workstation to the domain (ask about that) then managing them can be more complicated with domain gpo's.
3. Effort wise I am certain that making them local policies will take your more effort(depends on how much you need to customise them)
4. Local user vs domain user security. Well domain users will always be more secure than local user- centralized authentication- local authorization.

It seems that your disagreement is due to a lack of requirements understanding on both sides. I would sit with the other person and ask the following questions:

1. What is the scope of the workstations, what jobs will the users do, are they our employees?
2. How secure should their workstations be?
3. How will we update their passwords/ security policy?
4. Will I have the time for that in the future?
5. Is there any way we can improve this for our mutual advantage?
6. Try to explain the difference in effort it takes your for domain vs local policies.
7. Try to understand why he thinks the local ones will be better.
8. If everything fails, go out for a coffee with him/her and/or make a swot assessments https://en.wikipedia.org/wiki/SWOT_analysis

Hoping that this helps!