Re: Forcing mobile users to log into Domain account when in workplace
- From: "Herb Martin" <news@xxxxxxxxxxxxxx>
- Date: Sat, 19 May 2007 13:12:46 -0500
"Chris P" <chris@xxxxxxxxxxx> wrote in message
news:1179575616.802435.271990@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Thanks for your reply Martin.
The idea behind the usage of two separate accounts on each user's
laptop is more of a practical sense.
Generally it is not a good idea. Two profiles, two sids with differing
ownership/permissions, etc.
The local (laptop) account will be used when the user is at home. The
user has the ability to install applications he might want to use at
home. This gives him the ability to work with the machine almost
without limitations.
If you allow this, you might as well allow the use to install them for
both accounts -- or rather for the ONLY account.
The local user account will be part of the 'Power
Users' of the local machine.
Just make the domain account a Power User.
The domain account is to be used only for work. The user won't be able
to install any programs that are not related to his working
environment.
So what, he has the other account and can run whatever he wishes from
it -- anytime. It just isn't convenient.
The domain user has no additional privileges to install
or change settings under the domain account - restricting considerably
how much he can do, that's not related to his work.
With RunAs he can probably do most anything either account allows --
again, it just isn't convenient. There is no real security advantage to the
restricted settings once you give out the other account.
I need to figure a way to force the user log into his domain account
when he connects his laptop at the office, not allowing him access to
the local computer account.
Take away the local account -- it's the right thing to do anyway.
As a side note, I've been also looking into 802.1x, which looks
promising, but the problem with it is that when enabled, it works for
all accounts on the laptop. As an alternative, if I could enable
802.1x only when the user is logged into his domain account (locally
cached as you mentioned), then he can enter his username / password
and gain access to the network. If he logs into the local user account
and the 802.1x is disabled for that account, he can't join the
network.
Your thoughts and comments are appreciated.
.
- References:
- Prev by Date: Finding a Hacker
- Next by Date: LASASS error 0xc00002e1 and DSRM password
- Previous by thread: Re: Forcing mobile users to log into Domain account when in workplace
- Next by thread: Re: User Logon Time / Time Zone
- Index(es):
Relevant Pages
|
