Win2003 domain and clients

Brandon McCombs a écrit :
> Geckoloco wrote:
>> Hi all,
>>
>> I went to a client this week to see their system architecture and I
>> was surprised with the configuration. Let me explain :
>>
>> The server is a Win2003 with AD (domain name "example.local") and all
>> the users account were configured. Seems ok to me.
>> But when I went on a user's computer, it wasn't declared on the domain
>> but was configured on a workgroup called "example.local".
>> Never seen this...
>> The client did access to the server's share with her account (the same
>> that was configured on the server).
>>
>> How is this possible ? I fought the clients had to be on the domain to
>> access the server.
>> Could someone explain me this configuration please ?
>>
>> Thanks.
>
> Anyone can access a server share as long as they have the right to do
> so. The right being defined by the ACLs on the server share. Being that
> the clients aren't on the domain though the users will have to
> authenticate before they access any domain resource. Sounds like both
> you and your client need to learn a bit more about ADS, especially your
> client since they have no idea how to setup a domain properly. Access to
> server shares is a basic function of a domain (and workgroup for that
> matter).

Thanks for the answer.
I knew that users must authenticate on the server to access the shares
but I didn't know this type of configuration.
- If the client didn't had for workgroup the same name as the domain,
the user would have to authenticate the first time he access the share,
right ? (as opposite, now they just open their session and it works)
- What's the use of naming the workgroup the same as the domain ? I
don't get it.
- Are groups working for defining shares' access in this type of
configuration ? (server alone in domain and clients in workgroup)

I already configured AD with DNS, DHCP, etc with clients declared in the
domain but this config makes me sceptic. The AD is useless in this case,
they could've configured the users without AD, am I correct ?

Geckoloco a écrit :
> Hi all,
>
> I went to a client this week to see their system architecture and I was
> surprised with the configuration. Let me explain :
>
> The server is a Win2003 with AD (domain name "example.local") and all
> the users account were configured. Seems ok to me.
> But when I went on a user's computer, it wasn't declared on the domain
> but was configured on a workgroup called "example.local".
> Never seen this...
> The client did access to the server's share with her account (the same
> that was configured on the server).
>
> How is this possible ? I fought the clients had to be on the domain to
> access the server.
> Could someone explain me this configuration please ?
>
> Thanks.

Good. This clarify the situation.
There's a lot of work to get all this rollin' back correctly.
Thanks.

Hello Geckoloco,

Doesn't matter if the wokgroup name is the same as the domain name. The authentication
to the domain works also if the machine is not a domain member, as you can
see with the share access. Important is the correct username/password for
the domain account and you can login.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Hi all,
>
> I went to a client this week to see their system architecture and I
> was surprised with the configuration. Let me explain :
>
> The server is a Win2003 with AD (domain name "example.local") and all
> the users account were configured. Seems ok to me.
> But when I went on a user's computer, it wasn't declared on the domain
> but was configured on a workgroup called "example.local".
> Never seen this...
> The client did access to the server's share with her account (the same
> that was configured on the server).
> How is this possible ? I fought the clients had to be on the domain to
> access the server.
> Could someone explain me this configuration please ?
> Thanks.
>

Geckoloco wrote:
> Brandon McCombs a écrit :
>> Geckoloco wrote:
>>> Hi all,
>>>
>>> I went to a client this week to see their system architecture and I
>>> was surprised with the configuration. Let me explain :
>>>
>>> The server is a Win2003 with AD (domain name "example.local") and all
>>> the users account were configured. Seems ok to me.
>>> But when I went on a user's computer, it wasn't declared on the
>>> domain but was configured on a workgroup called "example.local".
>>> Never seen this...
>>> The client did access to the server's share with her account (the
>>> same that was configured on the server).
>>>
>>> How is this possible ? I fought the clients had to be on the domain
>>> to access the server.
>>> Could someone explain me this configuration please ?
>>>
>>> Thanks.
>>
>> Anyone can access a server share as long as they have the right to do
>> so. The right being defined by the ACLs on the server share. Being
>> that the clients aren't on the domain though the users will have to
>> authenticate before they access any domain resource. Sounds like both
>> you and your client need to learn a bit more about ADS, especially
>> your client since they have no idea how to setup a domain properly.
>> Access to server shares is a basic function of a domain (and workgroup
>> for that matter).
>
> Thanks for the answer.

I apologize for the insult.

> I knew that users must authenticate on the server to access the shares
> but I didn't know this type of configuration.
> - If the client didn't had for workgroup the same name as the domain,
> the user would have to authenticate the first time he access the share,
> right ? (as opposite, now they just open their session and it works)

As others stated in various ways, it just happened to work for the users
because their usernames and passwords for the local accounts matched the
credentials on the domain (don't know how they got that lucky). If they
were ever out of sync the user would be prompted to explicitly define
their credentials. I'm sure if this ever happened the users would be up
in arms because it can be quite annoying unless the user maps the share
to a drive letter and stores the credentials in the drive mapping
definition.

> - What's the use of naming the workgroup the same as the domain ? I
> don't get it.

There is no use. It sounds like a misguided attempt at creating a
domain. Hopefully you can teach them some things and make some money in
the process.

> - Are groups working for defining shares' access in this type of
> configuration ? (server alone in domain and clients in workgroup)
>

If I understand you correctly, yes, you can use groups for defining the
proper access to the server shares. The groups would exist in ADS if in
a domain and just local on the server the user is accessing if in a
workgroup.

> I already configured AD with DNS, DHCP, etc with clients declared in the
> domain but this config makes me sceptic. The AD is useless in this case,
> they could've configured the users without AD, am I correct ?

They could have but it would obviously be much more work both in the
beginning and for ongoing maintenance. The only thing really needed is
to join all the workstations to the domain and have users start
authenticating using their domain credentials. If you already have that
in place then you can define some groups and then add those groups to
the ACLs on the server shares so users can access them. Don't forget to
add the users to those new groups.

Brandon