0

I am setting up a domain controller and active directory at my job. I have everything working great (for the most part)... I have policies in place. I am getting a lot of static from the upper ups about this change, as they have had a DC/AD in the past and had all kinds of issues with it.

So with that said, our question would be: is there a way to run a DC/AD without having to use the domain users from the server to login and use the local PC user account?

In other words, I want to use the domain to handle only the policies for that computer and nothing else.

I'm hoping if I can take this step I will be able in the near future use it to its full potential.

Improve this question
2
  • 1
    The only reason they'd resit AD is if it wasn't set up correctly in the first place. I'm not quite sure what you mean though, you can set up computer policies or user policies. The domain controller would have one set of policies apllied, and the client machines another set. Once the client machines are set up and joined to the domain they can log in with domain accounts.
    – tombull89
    Mar 10, 2017 at 16:40
  • 2
    You wrote I am setting up a domain controller. That sounds singular. If you meant what you wrote, and you have only one DC, that's a single point of failure and will some day lead to any outage that reinforces their fears. Always build at least two domain controllers.
    – Clayton
    Mar 10, 2017 at 17:06

1 Answer 1

Reset to default
4

Even though you have / will be implementing Active Directory, the workstations and member servers still retain their own local databases. In short, people can still use local accounts to login in locally.

The workstations will be domain joined and they will still process group policies regardless of whether people login with a domain or local account.

However, I wouldn't recommend this. Active Directory is going to allow you to centrally keep control of Security / Auditing / resource access etc. The benefits of a good AD deployment far outweigh any negatives. If your users are authenticating using local credentials it will just give extra work for you and make it difficult for them as the company grows.

Improve this answer
3
  • Agree with this so much. @kelly the answer to 'higher ups have a problem with AD because it was badly set up in the past' isn't to say 'you call that badly set up? Hold my beer and watch this.'
    – Rob Moir
    Mar 10, 2017 at 17:25
  • agree 100% I have just learned that baby steps with them are some times the best but it sounds like going in head first would be the best option. I think im going to state with 3 servers one at each of our main sights and then bring one store online at a time from there. In order to use more then one domain controler for fail over would i set up tcp-ip/ wins address? right now im just changing one of the DHCP address to be the servers address?
    – Kelly
    Mar 11, 2017 at 4:15
  • Hi Kelly, TPCIP yes WINS probably not. Today Microsoft network use DNS and Fully Qualified Domain Names. when you install your first AD Domain controller it will install DNS for you.. can I ask, if my answer fits your question could you mark it as correct?
    – Michael Brown
    Mar 11, 2017 at 8:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .