I am working on a project where a customer wants a program on a few of their machines (touch screen machine interfaces) to be able to access Active Directory and use their Windows Logons within it. I got this working by adding the few machines to the test domain I have created and the software is working beautifully within this setup.

However the customer does not want these machines in the domain because they are supposed to have 100% uptime (or as close as possible being they are machine interfaces) and not have updates or forced restarts pushed to them by their company domain. My contact within the customer seems to think getting their IT to agree to not restarting or pushing updates to these machines is not on the table.

I was not able to get the desired domain logon behavior with the workstations in WORKGROUP and no trust relationship setup.

The developer of the software's support team said the work around should be adding each workstation to the domain as a trusted location but I can't seem to figure out how to do that, only add trust relationships with other domains.

Am I missing a quick and easy setting or can this only be accomplished with a small domain that does not push updates and restarts that is trusted by their IT's domain thus allowing their IT domain Users to log on to this software?

These are Windows 7 Embedded Standard Workstations and my Domain Controller is a Virtual Machine running Windows Server 2012 R2

  • 2
    Surely, the management software supports pushing forced updates to specific OUs only? You don't have to keep all computers under "Computers". – grawity May 23 '18 at 19:55
  • I would think so but my contact in the company seems to think otherwise. I am 90% sure that will be the final solution but wanted to check with some experts and make sure I was not missing anything – Evan May 23 '18 at 19:56
  • 1
    I mean, practically any AD-managed site will have a couple of actual Windows Servers as domain members (not to mention the DCs themselves), and an AD-based update deployment tool that can't do 2 different policies would be pretty worthless. – grawity May 23 '18 at 20:08
  • 2
    Seems the IT guys don't know what they're doing. You can control multiple GPO objects and link them to different UO's or deny computers from even applying GPO's in the first place. Many options to do this through the domain. – LPChip May 23 '18 at 20:15
  • Thanks, Looks like I will need to have a more in depth conversation with the customer about why they are trying to go in this direction – Evan May 24 '18 at 11:31

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.