User accounts and security in a work domain

imoani · 07 Feb 2013

I recently got my personal laptop connected to my work domain. I don't have much experience with the domain environment & wanted to find out some more info about it.

My local user account has admin privileges and since joining the domain it has now become "Sophos administrator" and has lost the rights to change many system settings. The domain admins also created a new user account (standard user) that allows me to access work printers and shared drives that my local admin account cannot access. This means I have to switch between accounts to access different programs/printers/files etc and this can be time consuming because I have to completely log off and then log back on as the other user. Looking at other threads it also appears that I will no longer be able to access my homegroup when I take my laptop home but I'll deal with that another time.

Anyway my questions are: Can somebody recommend a tutorial on how domains work, and whether I can consolidate both my user accounts without annoying the domain admins?
Also, in terms of my personal files & privacy, is there anything I should be concerned about? (I have turned off network discovery but do the domain admins have remote access to my computer?)

Thanks for your help & sorry if these are simple questions :)

UsernameIssues · 08 Feb 2013

"How domains work" has filled books guaranteed to put you to sleep. It sounds like you just need a bit of info as it pertains to domain accounts vs. local accounts.

Like you mentioned and like the name implies, a local account is good for doing stuff on the local computer (plus a few things the the domain admins might allow - like surfing the web).

And a domain account is good for doing stuff that requires you to identify yourself to the resource (printer, share drive,...).

Most likely, the IT staff start people out as standard users and then wait for them to ask to be admins. (Or they assume that users will just add their domain account into the admin group). You should ask your IT staff if you can add your domain account to the admin group on your computer. If they say no, then ask them how to handle the situations where you have been logging off and back on just to get stuff done.

If you don't know how to add your domain account to the admin group on your computer - let them show you how.

The domain admins are admins of your computer now and as such can get to most anything. Will they? Probably not. They have work to do.

If you want to keep them out of certain areas:
TrueCrypt - Free Open-Source Disk Encryption - Documentation - Tutorial
...or a product like that.

Layback Bear · 08 Feb 2013

I recommend when doing anything with a work environment get permission through the I.T. Department. I assure you they don't want people monkeying with their domain/network without permission from them.