What do you do when you have a pool of laptops that are given to staff when they travel? I work for a travel agency where we will send a staff member or two away on a tour with a group of people, and they need to continue to connect back to the office, clear emails etc.
What I want to know is this: Is it normal to connect these laptops to the AD domain as well, or would you leave them off the domain as standalone workstations?
FWIW, this is a SBS2011 Standard network, with around 25 staff and 8-10 laptops. It's not feasible to give each user one laptop.
As I see it, these are the pros/cons.
Connect the laptops to the domain (the pros/cons are more or less opposite for 'not connecting the laptops to the domain'):
- Pro: Better security (GPOs applied, problem areas locked down, Firewall rules setup appropriately etc.)
- Pro: Staff login with one account, and don't need a separate 'Laptop User' account that they need to remember the password for
- Con: WSUS won't work (see above reason)
- Con: Integrated AV doesn't work (AV updates require a connection back to the AV server which isn't accessible to the world) so it will scan, but not with the most up-to-date definitions. Given some people are away for a month or two at a time, that's not a great look
- Con: Staff have to remember to logon to the domain at least once before they leave while in the office, as the laptop needs to cache their logon. If they don't do this, the laptop is a brick, unless I give them the local admin account
Anything else I'm not thinking of?