During this time they’ll be attempting to authenticate with the old, invalid password and quickly lock out the NAA account. Such a change would be nearly instantaneous for the domain controllers (replication not-withstanding) but take hours for all your clients to get once you’ve updated the account in the console. Second, you don’t really ever want to change the NAA’s password. Do not trust whatever ‘encryption’ Configuration Manager uses to safeguard the NAA credentials. First, your NAAs should be true service accounts that are prevented from interactive logins to your domain devices. There’s two implications that come from this. The Network Access Accounts are sent to the clients as part of their machine policy and are stored ‘encrypted’ in a WMI class. To set up your NAAs refer to the Microsoft documentation linked above. The client will cycle through them until one of them successfully authenticates to the DP they are trying to reach. If you have DPs in multiple domains that don’t all trust each other you will need multiple NAAs. The client then retries with the Network Access Account (NAA). Since workgroup clients won’t have an Active Directory (AD) object that will always fail.
Every client will first attempt to authenticate with their local computer account. Particularly, how they authenticate to the distribution points (DP) when they need to download content. One of the critical differences between workgroup and domain clients is how they authenticate. Microsoft Doc: Manage accounts to access content in System Center Configuration Manager If I miss something, let me now and I’ll add it. Like all things however, there are exceptions to that rule and I will attempt to explain them all here. For the most part, Configuration Manager just doesn’t care whether your device is domain joined or not. Whether or not Configuration Manager can manage workgroup devices is a question that comes up fairly often on the Technet forums, Reddit, Slack, what-have-you.
However, for reasons that fall along the full spectrum of rational thought you may chose not to.
If you’re using Configuration Manager to manage clients then chances are you have the Client Access Licenses (CALs) to join them to the domain.
0 kommentar(er)
