If we have a computer on the network that is only used by one person that logs on using a local account, no noe will log on using a domain account, what are the pros and cons of joining/not joining this computer to the domain from a security stand point?
Joining a Windows computer to an ActiveDirectory domain is a trade off.
- Client management via Group Policy Objects (GPOs)
- Single sign-on access to resources and services
- Credential recovery (admin can reset your password)
- Lack of autonomy
- Need to be attached to the network or on VPN for first authentication (can be cached afterwards)
- Transitive trust attacks (compromise endpoint, pivot into services or systems, cryptolock shared file systems)
Client management and single sign-on are very significant advantages in a workplace or institutional environment. Managing clients individually rapidly becomes unmanageable even with small numbers of deployed workstations. Inconsistency breeds problems and undocumented vulnerabilities. Client management allows you to enforce aspects of your written security policy such as password complexity, local firewall rules, and software restrictions.
Single sign-on is significantly advantageous as well. It means being able to centrally manage the authentication of services allowing staff to either log in once (ideally) and have their credentials provided transparently to all integrated corporate resources. Without this you get a proliferation of credentials managed (likely poorly) by the individual services and users reusing the same passwords leading to compromise.
Credential recovery is a big one too. Without it a staff person could be left without access to their workstation and may lose work.
I think the security consequences of unmanaged workstations outweigh their benefits. Exceptions should be made for staff members demonstrating a dedication to defined security policies and a willingness to hand their machine over to be audited. One size fits all will annoy people and encourage non-compliance.