Local Admin when away from network.

[CMiller]

Hi All,

 

I've been playing with some GPOs and WMI filters to try and enable our users to access their PCs with admin privileges whilst away from the network. There's a few reasons for this but the primary reason being that we hide the C drive to prevent profiles/storage becoming fragmented between the local machine and the domain and they cant access their network shares when at home.

 

My first attempt was to use a WMI filter to ping the DC, if there's a response, apply standard restrictions, if no response then go local admin. The result being that everyone on a laptop is an admin all of the time, regardless of ping return code. Not the desired result...

 

Now I'm pulling my hair out, trying to find a solution. Any tips? Do any of you run admin laptops with restricted desktops? If so, how do you do it?

 

Regards,

C

[Steve21]

Offline files or Remote Access

 

Your C drive idea won't work, as when they come into the network it'll hide the C drive and they can't access the files to use? So what's the point in having the area :s And they don't need admin rights for that.

 

Steve

[3s-gtech]

Could you setup DirectAccess instead? This will be a much neater and more comprehensive solution, giving the same experience for users at home and work. Edited December 15, 2015 by 3s-gtech

[Sephiroth]

Offline files is the recommended solution for this. that's how our 200+ staff laptops are set up.

[sparkeh]

Direct Access is great if you have access to Enterprise versions of Windows (and server 2012 where setup is a lot easier than 2008), failing this some flavour of VPN would be a good idea. Or HAP+ perhaps.

Personally I have never got on well with offline files but some people swear by it so if you can get it working for you then this is also a good option.

Edited December 15, 2015 by sparkeh

[Sephiroth]

Admittedly offline files can be a bit of a pig to get right. once you're there, though it's ok. A VPN of some sort would be my next go-to thing, but I've never dealt with them on that scale and have poor experience with them personally, however ymmv.

 

Another way is to get something like Citrix XenDesktop (something we're looking into) for remote RDP on any device.

 

Never used Direct Access so can't comment on it. What I can say is to avoid things like RM Portico (talking from [bitter] experience) as they require you do donload files and then upload saved documents.

Edited December 15, 2015 by Sephiroth

[deano]

I accomplished the same thing recently with WorkFolders. Works a treat

[CMiller]

You guys are my favourite!!!!

 

After a few hours of banging my head against the desk, Offline Files is set up and seems to be working.

 

We'll what the users says in the AM.

 

Thanks all!

 

C