What would be the disadvantages of allowing a user to travel to China (business trip) using a domain-joined corporate Windows PC as opposed to a non-domain-joined PC?
closed as primarily opinion-based by Stephane, RoraΖ, Lucas Kauffman, Xander, Mark Dec 23 '14 at 21:11
Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.
On a domain-member PC: There are cached credentials of one (or more) administrators on the device. There are also cached credentials of any users that have logged into the device. There may be other cached credentials such as mapped drives, etc. on the device. Contents of My Documents, etc. may contain sensitive corporate information that has accumulated over time. An insider (while unlikely) could cripple the organization and/or cause great harm (ahem, Snowden...). These credentials and data can be "confiscated" during a customs inspection or while the user is (for whatever reason) separated from their device.
On a stand-alone PC: A freshly-prepared laptop with only the required data contents will be immeasurably more prudent for a traveler to any foreign country (not just China) from the standpoint of possible corporate or government espionage. Additionally, if the user is an insider the content they can steal will be limited to that of what the administrators prepared during the provisioning process.
It's hard to find any reason why it would be advantageous to sending someone with a non-domain joined PC as opposed to a domain joined PC.
Domain joining a PC has several distinct advantages
- Administrator can control update policies to software and anti-virus
- Administrators can control firewall settings and VPN tunnels / routing
- Policies of all sorts can be forced upon the machine easily and centrally administered (admittedly this can be done with some MDM's)
- Full Disk Encryption can be enforced on the PC
I'm not sure why you would think there is any security disadvantage to this machine being domain joined.
SIDE NOTE : Simply working on the Internet in China poses no additional threat to your system than anywhere else in the world. I'm not sure why people have the misconception that as soon as your laptop hits the Internet in China it will be infected with MalWare. Keep your PC locked, don't hand it over to anyone without witnessing what they're doing to it and pay attention to certificate errors and you (or your employee) should be fine.