Laptops not on the Domain

[Nick_Parker]

Hi all

 

I'm busy testing a new setup for our staff with laptops.

I started off with joining their laptops to the domain and configuring offline files etc...

Many of the staff (including myself) are finding the their laptops are painfully slow when not connected to the domain, not just in logging on, which can take up to 5 minutes! Sometimes you can click the start button and wait a minute before it pops up etc etc...

 

So I thought I'd try configuring the users as local admins.

Now they log onto their laptops much quicker, and any disconnects means things continue to work.

I put a shortcut on their desktop to their home drives and they currently enter the network credentials whenever accessing any network folders.

 

Can anybody please give me any suggestions/hints/tips on how to make working on the network as seemless as possible?

Domain clients have all their drives mapped via a logon script, the problem with local admins trying to do this is the script won't map the drives unless they've authenticated against each of the servers that it's trying to map a drive on. The only option I've found so far is that they enter their username/password when prompted via the script, and that passes it as it maps it?

[john_robbo]

We set up a local accounts on the laptops, and ask the staff to use these when logging in at home. They have to remember to change the domain to the machine name before they log in, but most don't have a problem with this. We don't use roaming profiles, so its really the only way for us to do it.

[Michael]

The only option I've found so far is that they enter their username/password when prompted via the script, and that passes it as it maps it?

 

That is how I do it and it works fine

[EduTech]

We also do as above, setup local accounts (Username Same as there network login) and give them local admin rights (which is not always a good thing mind) and then they just change where they logon to when their out of the building to (this computer) and when they come back on site to (domainname)

 

James.

[john_robbo]

give them local admin rights (which is not always a good thing mind)

 

You're right about that - I've had quite a few staff laptops come back to me running painfully slowly, the user pleading ignorance, only to find that they've installed a plethora of god knows what!

 

In the long run though, I think it solves more problems than it causes - in the "old days" we had staff bringing their printers in from home asking if we'd install it on their laptop for them because they didn't have the correct permissions...

[kmount]

Hi there,

 

When I worked at the school we joined the laptops to the domain as per normal, blocked the inheritence of group policy to the OU and set up a structure underneath.

 

We too experienced slow performance but we got around it by sorting the GPO's out to not wait for the network on boot up, and made sure we weren't redirecting anything to the network to cause timeouts.

 

In the end we opted to redirect the desktop, and my docs etc to a local folder on the C Drive and provided a back up script for them to run to robocopy the changes onto their home drive when they were here.

 

We had a login script which mapped all of the drives which worked fine.

 

We too added the member of staff as a local admin on the laptop (with their domain account) but had an AUP which stated that if a laptop came in with a problem as a result of their installing of 'non college' software we would reimage it from their last back up. (Of course, 9/10 times we did a back up first to avoid carnage).

[_techie_]

Welcome to the fun world of dealing with laptops for both home use and domain use! I am constantly trying to keep our laptop numbers down to keep them manageable. Seems to me like you have managed to keep it simple enough at the time being. Good luck!

[MicrodigitUK]

We use a rm cc3 network and don't seem to have any problems as rm seem to have the gpo's for laptops spot on the only tweeks that I have done is Microsoft ofline files. And if running sophos you must disable onaccess scaning of any M$ ofline files or it frezes up and is slow to respond.

[Oops_my_bad]

our staff laptops have a GPO setting enabled to remember the last 5 logins - that way they can take their laptop home and logon using just one username/password. Saves having different local accounts and all that stuff. Also our staff dont have local admin - 99.9% of software required is done through GPO.

 

Folder redirection & offline files - not used. We stipulate anything they want securely keeping, they should keep a copy on the network drive. They can fill their staff laptop up with as much cr@p as they want but know it's not backed up.

 

Not sure why your start menus take so long to appear - are you redirecting anything?

[deKay]

We were having problems with laptops and on network/off network use, mainly due to directed folders. Thankfully, I've resolved that now with loopback processing.

 

Hopefully this might be of use to some of you:

deKay’s Blog: Redirected folders on disconnected PCs using GP loopback processing

[deKay]

How do you deal with staff passwords on the laptops and on the network constantly going out of sync?

 

With my method the machines work pretty much as standalones with the benefit that we can still apply settings, software and updates via AD GPOs, and passwords are (generally) kept in sync.

 

We don't use offline files either.

[deKay]

Your staff are clearly superhuman compared to ours.

[sted]

Laptops here set up as standalone machines. Workgroup name same as domains. Local user a local admin user and details match that of the staffs domain account. Local My Docs and Map shared drives. Things like WSUS/Windows Firewall etc set via local GPO. Sophos deployed via EM. Plus a couple of scripts for changing proxy settings and for backing up local My Docs.

 

Works a treat. Can't stand Domained staff laptops and Offline Files.

 

i do aomwthing similar but domain them in their own ou with specific policies(so i can roll software out to them) then use gpo to block them logging in as a network user (except domain admins) so i can have gpos applied to them without having to edit local ones and users log in as local admins (unless they do something to get that privilage revoked) so no horrid syncing i just give them synctoy so they can run themsleves