Create Local User On Device

[keyboards]

This is probably really straight forward and I'm being dumb

 

We have a laptop, we want say the user jsmith to login into but we want so that when they go offsite they can still login to it ie locally without a network, in RM CC4 this was down via privilege users on a device

 

How do we do it in a vanilla network, as I'm sure I've done it a few times before but for the life of me can't remember

 

Thanks

[Alis_Klar]

Right click "this PC" and click manage. In computer managment look for "local users and groups"

 

Or Right click start button and click "Computer Management"

 

You cna login to a domain account offline as long as offline files is enabled but syncing of documents etc can be unreliable.

[MatthewL]

You should be able to login to the device in cached mode without been connected to the network and access everything that is local to you without the need for creating separate users.

 

I use my laptop like that more than I do on the network as I spend more time out on the road.

[Davit2005]

You should be able to login to the device in cached mode without been connected to the network and access everything that is local to you without the need for creating separate users.

 

I use my laptop like that more than I do on the network as I spend more time out on the road.

 

Indeed you will only have issues if you have not logged onto the laptop before taking off site and may to find issues if you change password then do not log off/on again before taking off site.

[3s-gtech]

You'll need the correct type of user profile for this to work too (Local, Roaming) and there are GPOs that will prevent a user logging on without network connectivity so you'll need to see if those are set.

[keyboards]

Thanks people, this worked a charm(until it goes wrong or they find an issue with the laptop)

[ITGURU]

I don't like caching users on laptops - you never know how long they might be used off the network for. What we do is setup a local user, so they login with .\ and their same username and password they login to the network with. They can then access all network drives remotely.

If they want to use the laptop in school, they logon as they would any other pc.

With caching, a user might be off sick, come to need to use their laptop and caching has expired then the user won't be able to use their laptop.

[fredbayker]

Also, cached passwords are a security risk especially if a domain admin password has been cached.

[mavhc]

You need to be local admin to read the cached password hashes though. Rule 0: don't let anyone be admin. Plus doesn't everyone use Kerberos now?

 

" In Windows Vista/Windows Server 2008 (and later), the log-on cache verifier is protected using PBKDF2, which is considered cryptographically very secure and is significantly more resistant to brute-force attacks than earlier protection mechanisms. It essentially takes the password, the salt, and a pseudo-random function, then mathematically computes them over thousands of rounds of identical computations.

 

For practical purposes, as long as your password is of decent strength (at least eight characters), cracking a Windows password hash verifier is nontrivial. That's crypto-babble for "ain't gonna be done by most people using today's available hardware."

 

In order for an attacker to get to a password verifier, he or she must be a local administrator, which gets the attacker to Local System to retrieve the verifiers. With that level of access, an attacker is far better off stealing the regular password hashes or password sniffing. Why try to get to something that's hard to crack when you can, with the same effort, get something that works every time without additional hacking?

 

It can't hurt to limit the number of cached log-on profiles, as Microsoft recommends, but there isn't much value to doing so. Cached log-ons can't be used in pass-the-hash attacks, can't be used as authenticators, and certainly aren't high risk in most environments."

[Davit2005]

Also, cached passwords are a security risk especially if a domain admin password has been cached.

 

Should avoid logging in as a Domain Admin. Create elevated accounts for Domain Admins and use these only if required.

[fredbayker]

Should avoid logging in as a Domain Admin. Create elevated accounts for Domain Admins and use these only if required.

 

You’re absolutely right, and believe me I’ve tried but I’ve met resistance from my own colleagues here. I’m not the network manager so I can only suggest unfortunately. I don’t want to say too much, but there are many bad practices here!