Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I know policies can be imposed from a network administrators point of view to make things easier to manage and control, but what does a user lose out on by not joining a domain?

For example, let's create a user account on the company domain as follows: domain "Company" username "John" password "password"

And let's set up a machine as follows: workgroup "Workgroup" username "John" password "password"

Since local and domain credentials are the same, "John" can map shared resources on the domain and add network printers (apparently without the need to provide credentials when doing so). Furthermore, "John" might be able to simultaneously access shared resources on any other domain, providing his credentials are the same on these other domains.

"John" would still be limited by what his domain user account permissions allow on the domain, but I gather would be free to do as he pleases on his local machine.

Regardless of whether my domain is set up properly or not (for the time being), what downsides exist for John's computer not being on the domain (again, from the user's point of view)? One thing that comes to mind is a roaming profile...what else is there?

share|improve this question

closed as not constructive by CharlieRB, Dave M, Nifle, Tog, 8088 Feb 12 '13 at 22:14

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

    
As per the faq, "You should only ask practical, answerable questions based on actual problems that you face. Chatty, open-ended questions diminish the usefulness of our site and push other questions off the front page." If there is a real problem you are dealing with, please edit your question to avoid it possibly being closed. –  CharlieRB Feb 12 '13 at 15:57
add comment

1 Answer

I've seen this practice called "mirrored accounts", and used when networking/policy prohibits domain joins. However, off the top of my head:

  • The user can't change his domain password from his machine. If the domain requires periodic password changes, the user may get locked out.
    • Even if he manages to, he must also change his local password at the same time.
    • Other apps (Outlook with Exchange, Lync) will probably need the password entered - and updated - separately.
  • A domain-joined machine gets corporate domain policies, which the user may consider a benefit (or not).
  • If the domain uses transport-layer IPSEC, the non-domain-joined machine won't be able to connect to domain-joined machines (expect designated boundary machines, like the DC itself - so it can join in the first place).
share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.