If we have a computer on the network that is only used by one person that logs on using a local account, no noe will log on using a domain account, what are the pros and cons of joining/not joining this computer to the domain from a security stand point?

  • There are a huge number of variables here. Generally speaking, you have less ability to manage the user/machine if not joined to the domain, and an attacker who compromises the machine has less ability to leverage it to execute an EoP attack on the domain. YMMV, however, depending on the specifics of the scenario.
    – Xander
    Nov 21, 2015 at 1:24
  • That is what we are trying to weigh the odds on. On the domain we can manage the computer much easier, off the domain prevents access to domain resources which this computer doesn't need or allow other domain users the ability to log onto the computer. Nov 21, 2015 at 15:43

1 Answer 1


Joining a Windows computer to an ActiveDirectory domain is a trade off.


  • Client management via Group Policy Objects (GPOs)
  • Single sign-on access to resources and services
  • Credential recovery (admin can reset your password)


  • Lack of autonomy
  • Need to be attached to the network or on VPN for first authentication (can be cached afterwards)
  • Transitive trust attacks (compromise endpoint, pivot into services or systems, cryptolock shared file systems)

Client management and single sign-on are very significant advantages in a workplace or institutional environment. Managing clients individually rapidly becomes unmanageable even with small numbers of deployed workstations. Inconsistency breeds problems and undocumented vulnerabilities. Client management allows you to enforce aspects of your written security policy such as password complexity, local firewall rules, and software restrictions.

Single sign-on is significantly advantageous as well. It means being able to centrally manage the authentication of services allowing staff to either log in once (ideally) and have their credentials provided transparently to all integrated corporate resources. Without this you get a proliferation of credentials managed (likely poorly) by the individual services and users reusing the same passwords leading to compromise.

Credential recovery is a big one too. Without it a staff person could be left without access to their workstation and may lose work.

I think the security consequences of unmanaged workstations outweigh their benefits. Exceptions should be made for staff members demonstrating a dedication to defined security policies and a willingness to hand their machine over to be audited. One size fits all will annoy people and encourage non-compliance.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .