WinNT domain and visitors

Have you considered giving them wireless cards and setting up a wireless router? This way you don't have to modify your network and you have control over their communications - for example you could leave the wireless side pretty much open but block most communications from that side at the router.

Hi Wbarker,
Interesting point of view.
But our network covers a large area (1Km) and 7 buildings. Only one wireless router can't do this job.

How many laptops/notebooks are you talking about?

Generally I recommend setting up NetSwitcher software on the laptops (for consultants) in order to facilitate their connecting their computers to the network they are attending to.

It sounds as if netswitcher might work for your situation but you'd have to install it on each laptop and teach them how to use it. Then the Administrator at each site should be able to work with them and setup a profile for each domain that they are needing to use.

www.netswitcher.com

good quest.

Have you considered creating Trust relationships between the various domains?

Immediately what this will do is allow the local domain controller to recognize and accept the credentials supplied by a user whose home domain is elsewhere. This doesnot mean that all users in all domains automatically have access to all resources. The local domain administrator still maintains control over what resources visitors can access. The local domain admin does this in essentially the same way as setting access permissions for users in his own domain, except he chooses an account from another trusted domain. One caveat to this is that any permission given to the Everyone group is automatically granted to ALL users in ALL trusted domains.

Whatthis does for you:

Any user from another location can log on using the credentials from their home domain. They automatically have access to any resource that has permissions set for the Everyone group. They have access to any other resources that the local domain admin has given specific permissions for. The local domain admin can immediately withdraw these permissions once the visitor has departed. No changes must be made to the traveling user's laptop. You don't have to worry about removing workstations from one domain and rejoining them to another in order to gain access.

Hope this helps.

Mobile users in this scenario are not any fun. I know. I have to deal with this myself. On Friday, I set up a user to take a laptop to go to our Frankfurt office.
In my organization, we do not have Windows trusts between the different domains. We are on a WAN, and can see the other networks, but there are security concerns that do not allow the necessary open ports between the offices. Therefore, no trusts.
So, when someone travels from one office to another, a few steps happen.
1) DHCP runs in each office, with its own IP assignment. All of our offices run different internal Class C address space on the DHCP servers. This is just to make it look clean when you chart out the offices (each office on a different 192.168.x.0/24 network).So, the mobile user arrives in the other office, plugs the CAT5 in, and get an IP. The DHCP scopes all have the proper router and DNS configs so as soon as the laptop user has an IP and logs in LOCALLY to the laptop, they can get onto the Internet.2) All users log into the laptop they will be taking BEFORE they leave their home office, so their Windows login/password will be on the laptop. This gets rid of the annoying having to authenticate to their PDC. Win2K/XP both cache the logon credentials and do NOT present a login warning when you log in and the PDC is not available. (NT also does this, but you get that annoying warning message when you log in when your PDC can't be found).

Anna777
I know about NetSwitcher, but is not usefully in this situation:
-the mobile users must have full control on their laptops
-or I must to know\have the local admin rights
-require: computer and user accounts in our domain
-every time must join to a domain or other domain
-and the laptops are not every time the same

Hi Tim,
It is true that I doesn't use until now the "trust relationship", but how will be done this, if we don't have any link between networks? How will be authenticating users and workstations if I can't contact other domain?

How I will establish a trust relationship between domains?

Hi Joseph,
A little problem with DHCP.
Not all our workstation has access to Internet. It is possible that the DHCP will assign a restricted IP to visitors.
A big problem with the batch file.
If I give to visitors this batch, they can see the , and . With these information they can do a search on network and logon to other resources like member of the group.

Your solution will require some orginization between the other company IT's. At each location decide on a block of tcpip addresses to be assigned to the roaming laptops. Since there is no interconnection the block of addresses can be duplicated at each location.

Once this block is decided assign the addresses to the laptops.

Now at each location assign these addresses to a pool and assign the required policies and restrictions according to the tcpip in this pool.

You can assign a common folder on the server to allow the restricted pool to swap files. The router can allow the pool access to the internet.

With out admin access to these laptops your solutions are limited and your problem is compounded.

Good Luck Lee

Hi Wlbowers,

"You can assign a common folder on the server to allow the restricted pool to swap files"

I don't understand how I can manage the access to a share folder, based on a restricted pool (IP adresses).
Can you give me more details about this?

Several things I see you need solved: PC and User from an other domain with preset DHCP configured pc?s require access to your network for Internet and to be able to use limited resources. Domains are not physically connected. No user rights to change network TCP/IP properties of the connection.

Hope this helps.

Moore has more than addressed this but here are the basic steps.

1.) Reserve a DHCP IP address in your subnet scope, which has Internet access. You will need the Mac address of the Laptop either from the pc or from the other domain administrator.

2.) Create a new ?Outsider? user account and add to newly created ?Outsider? global group to be used for limited resource access.

3.) Create new Directory on file server; add the ?Outsider? global group along with other global groups required to the new directory permissions. Add the ?Outsider? global group to server directory folders and change the ?Type of Access? to ?No Access? that you do not want this group to see.

4.) Create specially modified log-on batch file to assign to these new special user(s) mapped drives to newly created directory.

5.) Add the laptop computer name to the domain allowing log-on to your domain.

New user(s) should be able to access Internet and local resources by logging on to your domain with controls in place giving flexible solutions giving them a secure and temporary access to your network.

Hi Mjost,
As you said:
"No user rights to change network TCP/IP properties of the connection."
Then you missed that:
I can't authenticate in our domain the Notebook or Notebook's users.

I have 2 answers that may help, 1 is quick and dirty, and the other is long and involved, and ultimately (IMHO) necessary.

1) If only internet access is needed, then create a zone between your linux Proxy servers and your internet router for guest users, and have the internet router serve DHCP. Send a memo out to all remote site admins that all traveling users should be set to receive IP addresses via DHCP before traveling.

2) This may be a bit beyond what you are looking for, but if IT is going to work for your company on a global scale, then you have to start thinking that way. If the flow of information is crucial between your companies, then a central IT body should be established consisting of the various Site Admins answering to the CIO, or a committe of CIO's if there are more than one in your group. A plan should be developed to Globalize IT for your comapny. This plan should include a number of ideas not including but not limited to the following. A central location should be selected and it should act as a HUB for operations. Each location should install a VPN capable router or firewall and point to point VPN connections should be established to this central hub. Trust relationships should be established for all the related domains, and a core team should be formed to oversee the Network on an enterprise level. A change control body should also be formed to over discuss local changes that may have a global impact. Local site admins will still have control over their own domains as before.

This change will have to happen at some point in your organization. Maybe you can be the one to get the ball rolling. The only way to get a ball like this rolling is to do a business study and an ROI analysis, and present that to upper management and get their buy in.

Good luck!

Hi CB,
About the second point.
Yes, we must do something in this direction.
Next year we will implement the SAP in our company. This product is allready instaled in other location.
This is the best solution but this need time.

Your situation is complex, is it possible to try an external type solution.

1a. Set up a dial up account with an ISP in each country or city or region.

1b. Have each network install a dial-in capability on a sub-lan with good security checkingof ID and password. This would be a bit more work and cost but would provide better access and security.

2. Arrange to have all corporate laptops set up with a dialler where the user has the authority to change the phone number, ID and the password. Can be done in the security settings for the dialler itself.

3. Then the visitors just adjust the dialler settings and log on either via the ISP or the dail in system.

I would recommend the extra work and hardware for a local dail in capability as you could then link them straight into you network and you could easily adjust the dial in sub-lan as required. This would also allow you to set up the dial in system to accept calls only via the internal phone system if you wish.

I think the best solution would be to set up trust relationships between the domains. If there are login difficulties, a guest account could be created for mobile users. A VPN may be very helpful also (especially if some of the data is sensitive).
This should help explain Domains and Trusts:

http://www.winnetmag.com/Articles/Index.cfm?ArticleID=2571&pg=1&show=494

http://www.winnetmag.com/Articles/Index.cfm?ArticleID=3778&pg=1&show=556

Here is a short description of how to set up trusts:

http://www.ntfaq.com/Articles/Index.cfm?ArticleID=13522

Here is an excellent list of resources for VPNs and their setup:

http://www.labmice.net/networking/VPN.htm

Good luck...hope this helps!

Best and quickest way is get a set of IP's that are not in use but, are a part of the network. Turn on DHCP and allow DHCP to handle the process. This will allow for Internet access and will also restrict users from accessing secure areas of the network.

This question was closed by the author