A client has inquired me for a DLP software to lock USB and CD Drives. I contacted few companies and the DLP tool needs a Domain from where the software can control the nodes.
The client says that they have 55 machines in a WorkGroup and also has 1 server. I am not following what exactly is a WorkGroup and a Domain. The DLP tool specifications say that the network must have a Domain and Active Directory Services.
A workgroup is a collection of computer that are networked together, but do not have a central point that controls logon or permissions. Each computer in the workgroup maintains its own list of user accounts and passwords and the permissions that each account has on that computer.
A domain has one (or more) servers that take the job of Domain Controller. This domain controller has a directory service on it (called Active Directory), the directory maintains the list of user names and passwords. It also keeps track of which PCs are members of the domain. Any user account known the the domain controller can be used to logon to any PC that is a member of the domain.
More importantly the domain controller can apply policies to computers or users. These policies can control lots of aspects of the computer, ranging from removing certain icons in control panel though to installing certain software on all computers.
I would suggest that with 55 workstations, a domain would be a good plan anyway. They can also then centrally manage the windows patching of the workstations using a tool called WSUS, can run a central virus scanner management console that would ensure all workstations had up-to-date anti-virus.
here appears to have some good information about other beneifts that an AD deployment can bring and also information on planning for it.
McAfee DLP integrates with ePO, which supports running with computers in a workgroup.
