0

I've recently eradicated Active Directory from my network. However, I'm having trouble verifying there is no issue with sharing files using a local account instead of a domain account.

I have exactly one server I was unable to convert to using OneDrive/Sharepoint. This server has one folder that I will need to allow sharing to a limited number of people. I plan to do the following:

  1. Create static ips for users that will need access to the share
  2. Create Windows Firewall rules on the server to only allow those users' ips
  3. Create local user accounts on the server
  4. Share the folder with the local user accounts
  5. Setup mapped drives using the accounts

Are there any scenarios where using a local account instead of a domain account is more vulnerable? For example, I recall that with a Domain Controller, you can enable signing of security tokens using group policy. If the local machine is already configured to enable signing, will that still work?

Are there any other things I should look out for with using a local account other than the non-technical things like the hassle of maintaining the local users? I am primarily looking for any technical vulnerabilities that become present once Active Directory is no longer used for authenticating access to the share.

NRA
  • 1
  • Why on earth do you want all the hassle with manual whitelisting and maintaining static IP's, when you can use centralized authentication? From a operational perspective this is a nightmare. The maintenance of this solution will be hard, which will likely lead to security issues down the road, with users not being revoked in a timely fashion or at all and so on. – vidarlo May 12 '22 at 18:24
  • The reason I'm not worried about this is because it's only 3 users who need access and those users will not be changing. We have 0 turn over. I have all workstations Azure AD enrolled for central auth, but I'm not aware of any way to authenticate against local shares using Azure AD auth. Azure File Shares is an option, I guess, but I'm curious to know if there are any issues with the configuration I described. – NRA May 12 '22 at 18:27

0 Answers0