Quick background: I've been working with group policy since Win2k; I'm in an organization that's just getting around to rolling out Active Directory. I've got a few cases where I need to provide access to a desktop session and a few applications on a descent number of workstations (~40). The users won't be individuals who have managed AD accounts in our domain. I've mocked up a very restrictive computer and user policy (not local group policies), and want to apply to these ~40 workstations. I'll have a few different user accounts that can only login to a subset of these devices. For argument's sake, let's say 4 users that can logon to 10 unique workstations each. The password will be known to the staff that support these devices.
I've done this many times in the past by creating similar restrictive policies. These logins don't have any privileges outside of the local devices that they're logging into, which is enforced by policy.
I've gotten into a spirited discussion and the other end of the discussion is telling me that I should use local accounts and local group policy on each of these devices instead of using domain accounts (with most privileges revoked) and domain policy applied to respective OU's and filtered by domain groups.
It's considerably less efficient for me to write some sort of script to copy local group policy objects. I don't get access to all of the settings that domain policy gives me, and I then have to "manage" local user accounts and passwords on all of these devices.
I'm being told that the reason I should go this direction is because the domain user accounts are "more risky" than the local accounts because they aren't local accounts. My argument is that with proper policy application, both instances present the same risk -- that someone can login to those machines and get a deskop/access to applications -- which is actually the requirement, so the articulation of risk is exactly my requirement. It is a known risk that I must take to fill the requirement -- regardless of which way I accomplish it.
What am I missing? I've done this many times, but I'm being told that I'm wrong without any articulation of what I'm doing wrong. I'm just being told to do it with local accounts and policies.
Should I ever use local group policy to do anything that I can accomplish with group policy?
Thanks for any insights and experiences you can provide to backup/refute my assertions.