Re: Logon difference in Workgroup and domain
- From: "Joe Richards [MVP]" <humorexpress@xxxxxxxxxxx>
- Date: Thu, 14 Dec 2006 07:15:47 -0500
Q1: This is how LANMAN has worked forever. Prior to the domain concept, the only way to share resources was with a synced userid and password. The chances of synced IDs and passwords should be very low if people are following good security practices.
Q2: A domain administrator has administrator rights across all machines in a domain unless someone has removed the domain administrator group from the administrators group of a specific machine. However, due to features in the OS, the domain admins could always re-add themselves to the administrators group of any machine they are kicked out of that is in the domain. If you have two people on a DC, one is an admin and the other is a domain admin, they effectively have the same power on the DC. But the person who was an admin on a DC wouldn't necessarily have rights on any member machines, though they could take it anytime they wanted simply by adding themselves to the domain admins group.
joe
--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net
---O'Reilly Active Directory Third Edition now available---
http://www.joeware.net/win/ad3e.htm
yuebing.wu@xxxxxxxxx wrote:
all document and comments focus on central and discrete administration..
I want to ask some detail.
Q1:
in a workgroup, create two users with the same user name(U) and the
same password separately on two PCs(PC1 and PC2).
Create a share folder on PC2 and make it only accessfull to the
user(U).
User(U) on PC1 can access the share folder on PC2.
I can not understand WHY user on PC1 can access PC2's resource as PC2's
local user.
the two users on different PC are definitely two users!
The across-PC access is unreasonable, because if two PCs are
administrated by two local admins, there could be probability that the
two admins create users with same name and password on their PC, it is
not reasonable to allow their resource to be access by a same-name user
on other computer.
Q2
Local administrator VS domain administrator
Who has more power?
What is difference between them when configuring a domain-controlled
COMPUTER or service?
- References:
- Logon difference in Workgroup and domain
- From: yuebing . wu
- Logon difference in Workgroup and domain
- Prev by Date: Re: User accts begin disabled and locked out
- Next by Date: Re: restore child domain
- Previous by thread: Logon difference in Workgroup and domain
- Next by thread: Re: Logon difference in Workgroup and domain
- Index(es):
Relevant Pages
|
