0

I am working on a project where a customer wants a program on a few of their machines (touch screen machine interfaces) to be able to access Active Directory and use their Windows Logons within it. I got this working by adding the few machines to the test domain I have created and the software is working beautifully within this setup.

However the customer does not want these machines in the domain because they are supposed to have 100% uptime (or as close as possible being they are machine interfaces) and not have updates or forced restarts pushed to them by their company domain. My contact within the customer seems to think getting their IT to agree to not restarting or pushing updates to these machines is not on the table.

I was not able to get the desired domain logon behavior with the workstations in WORKGROUP and no trust relationship setup.

The developer of the software's support team said the work around should be adding each workstation to the domain as a trusted location but I can't seem to figure out how to do that, only add trust relationships with other domains.

Am I missing a quick and easy setting or can this only be accomplished with a small domain that does not push updates and restarts that is trusted by their IT's domain thus allowing their IT domain Users to log on to this software?

These are Windows 7 Embedded Standard Workstations and my Domain Controller is a Virtual Machine running Windows Server 2012 R2

Improve this question
5
  • 2
    Surely, the management software supports pushing forced updates to specific OUs only? You don't have to keep all computers under "Computers".
    – u1686_grawity
    May 23, 2018 at 19:55
  • I would think so but my contact in the company seems to think otherwise. I am 90% sure that will be the final solution but wanted to check with some experts and make sure I was not missing anything
    – Evan
    May 23, 2018 at 19:56
  • 1
    I mean, practically any AD-managed site will have a couple of actual Windows Servers as domain members (not to mention the DCs themselves), and an AD-based update deployment tool that can't do 2 different policies would be pretty worthless.
    – u1686_grawity
    May 23, 2018 at 20:08
  • 2
    Seems the IT guys don't know what they're doing. You can control multiple GPO objects and link them to different UO's or deny computers from even applying GPO's in the first place. Many options to do this through the domain.
    – LPChip
    May 23, 2018 at 20:15
  • Thanks, Looks like I will need to have a more in depth conversation with the customer about why they are trying to go in this direction
    – Evan
    May 24, 2018 at 11:31

0

Reset to default

You must log in to answer this question.