I hope that helped and answered your questions.
Which of my questions were you answering?
I was interested in clarifying the issue of decentralized workgroup computer management (from client workstations) and you are continuously deviating all my question to domain management
to which owners of client machines do not have any access.
Centralized management simply does not make any sense in many situations of environment with huge amount of computers.
For ex.,
1)
my ISP provides internet connections to hundreds of thousands of home computers.
Do their owners want their computers and accounts to be managed, i.e. restricted by ISP domain group policies, etc., etc. to which they do not have any access?
No!
It is the other way around!
2)
Developers need to fully and flexibly administer their development environments without centrally induced restrictions to which they do not have any access while using domain policies.
Hi vgv8,
I honestly thought I answered your questions regarding the differences between domain and workgroup machines including their limitations, options, etc, through discussion, explanations, and examples.
As for your latest questions:
1)
my ISP provides internet connections to hundreds of thousands of home computers.
Do their owners want their computers and accounts to be managed, i.e. restricted by ISP domain group policies, etc., etc. to which they do not have any access?
No!
It is the other way around!
That's correct, and neither would I. ISPs manage traffic and content (web based, protocol based, or app service based, such as possibly restricting torrent and P2P traffic, etc) to their customers, as much as some customers have complained to the FCC about
this. This type of management is much different than domain management and not related whatsover to difference between domains and workgroups. I mean you can also have services in place in a corporate environment that restricts this kind of service, too.
Domain management includes security policies regarding account logon, attempts at logon, logon restriction times, access to resources (such as shares, servers, printers, etc), authentication protocols (NTLM, NTLMv2, Kerberos, etc), centralized Windows firewall
settings, logon scripts to control what's being mapped or other factors, etc. Matter of fact, with GPOs, you can manage domain machines and user account specifics with over 800 to 1000 different settings, the number of which dictated by the version of
the operating system AD is running on.
So as you see, there are quite a bit of differences.
2)
Developers need to fully and flexibly administer their development environments without centrally induced restrictions to which they do not have any access while using domain policies.
I can understand that totally. I've heard that complaint numerous times in large corporate environments. I've seen in many environments where the developers are restricted to what they can do. The reason behind it is corporate network security policies.
Many companies, depending on their LOB, may have local, government or other restrictions and guidelines they must follow and adhere to, otherwise face penalties. Therefore they simply restrict what anyone can do, including the dev team, as much to their dismay.
They may provide you full control of the local machine, or simply allow you to develop on your own either member server (joined to the domain with possible restrictions), or stand alone servers that have no domain policy restrictions, but still may have internet
traffic restrictions.
I hope I was able to provide you the answers you were looking for.
Ace
Ace Fekay, MVP, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003, Microsoft Certified Trainer, Microsoft MVP - Directory Services. This posting is provided AS-IS with no warranties or guarantees and confers no
rights.
