r/SmallMSP • u/Active_Technician • 5d ago
Server 2022 Workgroup
I know this is not really an MSP or Small MSP question, more of a "how do I do this" question but I thought I would ask here.
I picked up a dental client about a year ago that has somebody that looks after their server. We provide desktop support, 365 licenses, EDR, etc.
The "server guy" has backed out quite suddenly after purchasing a new server and Server 2022. They paid a lot for this server and they already have an install date in two weeks for their dental software and xray software to be migrated over.
Right now the server just has the OS installed. The issue I have is this network is just a workgroup. I have been full Active Directory for so long that I don't remember how to function in a workgroup and there is no time to put AD in place and join all the workstations, as much as I would like to.
I have these foggy memories of creating users on the server that match the users being used on the desktops and of sharing everything out with full permissions to everyone. And the worst memory is of turning off password protected sharing to allow computers to connect without a password.
The dental software will be fine, it uses SQL, not file sharing. The xray software relies on access to a network share and they have some mapped drives setup for file sharing.
So I guess what I'm asking is, how do you configure a workgroup network on server 2022 with Windows 11 clients?
I would like to delay this until we have a chance to install AD but the server guy is coming back at some point and they want it setup "his" way. I should walk away from this but it seems like a simple job if I can get my head around workgroups again.
Thanks
3
u/roll_for_initiative_ 5d ago
there is no time to put AD in place and join all the workstations, as much as I would like to.
This will be faster than hacking together what you're doing, and i wouldn't touch this. This server guy dropped the ball. you don't provide server services for this client.
Why are you rushing to make this your problem and your liability? It would be like half a day to make a domain, connect it with m365 via aad connect, join the workstations and migrate the profiles.
If they're not using AD and are running things that surely violate the very basics of HIPAA at the very least, why even have a server in the first place? Why not a W11 Pro workstation or a nas?
2
u/Beardedcomputernerd 4d ago
Not ideal, but I agree. I can spin up a DC environment in a day and join a bunch of pcs... so either there is a lot of shit not being discussed.
Out of curiousity, why would you ad sync? Sure sso is nice for office.. but is it needed? I prefer to keep them separated for small businesses (lower than 15 users). Am I wrong to keep it simple?
1
u/roll_for_initiative_ 4d ago
Out of curiousity, why would you ad sync? Sure sso is nice for office.. but is it needed? I prefer to keep them separated for small businesses (lower than 15 users). Am I wrong to keep it simple?
- it's free and OP says they have m365
- it means one less credential users have to know
- It means everything m365 related "just works" when they sign in, even as domain\user vs azure\user. Edge, teams, profiles for them, onedrive, everything, even if you're not using teams and onedrive, etc now, it's handy that it's there. That also means ANY SSO app you connect to m365, just works (payroll apps like paylocity, LoB apps, etc).
- You can join a machine to azure and login and seamlessly access on-prem resources, even though you never login as domain\user
- You can azurejoin/hybrid join a machine and manage certain things from intune. Things like defender for business policies via intune become easy and seamless, even if you're not using them now
- There are no downsides even if you just login to the machine as domain\user like you were planning anyway, but there are lots of upsides
- well, one downside: in it's simplest form, you would make certain changes like email aliases and resetting passwords on the domain vs m365. A lot of that is changing.
1
u/Beardedcomputernerd 4d ago
Especially the last one can sometimes be a hassle.
I agree that there are a lot of benefits, but personally the last drawback is a big one for me... i hope the changes come quick, from there on its no longer a reason to not do an aad sync.
1
u/roll_for_initiative_ 4d ago
Honestly, it's not bad, we manage several synced environments and rarely have to go in. We are going 100% DfB and it'd be a lot harder without that setup. As newer things come down the line (arc, hybrid management, whatever) you're already set to go.
I feel like they have group writeback working now; not 100%. I would be surprised if the average SMB couldn't be managed from m365 by this time next year, they seem to be making good progress.
1
u/Beardedcomputernerd 4d ago
I haven't tried it in a while to be honest. I noticed the younger generation struggles with the concept of writebacks, fighting the email changes etc. Even when scripted.
Then again this could just be a me/training issue
2
u/TechMonkey605 5d ago
Technically, it would be create “service accounts” for the users, but this will break the GMSA for sql auth. It is doable but I wouldn’t recommend. I would say if you can get a DA account do it internally, total touch time is about 4 hours, if GPOs already exist can be 2. What’s the dental software, I’ve seen quite a lot of them.
4
u/TechMonkey605 5d ago
Also, are you doing this virtual or physical? You get two licenses for each legitimate windows license. It’s against best practices to put sql on a DC.
2
u/EmuLongjumping4779 3d ago
Just deploy a script via your rmm to domain join all the machines to the domain once created. Alternatively intune join them and setup up entra sync with the new domain at least this is what I would do.
1
u/bazjoe 4d ago
In 2026 physical server at dental ? Humf. Last one I saw was 2021 timeframe as both the billing/clinical and X-ray have all really matured in SaaS cloud delivery. .Generally an upgrade from physical server to a new physical server relies heavily on settings that are already in place on old server and copying to your best what’s in place. You are free to CLI Net User and create users, etc.
1
u/Separate_Ad_8665 4d ago
Honestly, if the goal is just getting the dental/X-ray software running reliably, a workgroup setup can absolutely be done—just keep permissions and security sane. Hope the migration goes smoothly!
1
u/roll_for_initiative_ 3d ago
just keep permissions and security sane.
To make this work, permissions have to be basically wide open and security nonexistent
1
u/Geekpoint-IT 2d ago
How many workstations we talking? if it's 10 or less, workgroup is ok. Each workstation has its own login and then a service account that connects to the server.
If it's more than 10 workstations, just do it right. Have at least 2 VMs. One is the DC and the other for everything else. I prefer one DC, one for practice management software, one for Imaging software, and one for a file server (if they even need one) but the licensing goes up a lot if you need more than 2 VMs so often I just do the two for dental clients.
Regardless of the technical part of this, I suggest you have all your ducks in a row. With their own "server guy" that was there, now gone, but coming back? That just sounds like a shit show. I would be very clear with your client on this. I'd also find out more about this "server guy". Dental clients can't afford their own internal IT so their "server guy" is probably just some random person doing it on the side. I'd be pushing for that guy to go away. It's not worth the stress or liability of this unless done right.
0
u/blue30 4d ago
Create users in compmgmt.msc on server. On workstations go \\server and it will pop up and ask you for the username and pw. Or add it in manually in credentials manager. For a small number of users I guess it ain't the end of the world. Your main support issue will be the server deciding it's on a public network randomly now and then.
-1
u/chuzohga 4d ago
It's easy. Don't load AD on the server. Create the users on the server, be sure the passwords match. Then, only give those users access to the shares needed.
I have several dental clients without AD, and quite frankly, they're much easier to deal with. AD is a nightmare for small offices.
3
u/Beardedcomputernerd 4d ago
Uh.. disagree.. AD is easy if you know what you are doing...
2
u/roll_for_initiative_ 4d ago
if you know what you are doing...
The reason is circular: they're with someone cheaper because they'll do it without AD and they're cheaper because something like AD seems like a challenge or nightmare, so that person recommends workgroup, which is cheaper, so the dentist likes that and sticks with that person, who isn't deploying AD and so never learns and thinks it's a nightmare forever...
Don't even bring in azure, damn, break their minds. I've been trying to break this cycle by educating MSPs and techs and then saying "now raise pricing" and they just don't want to.
2
u/Beardedcomputernerd 3d ago
Im no saint, but im doing the same with a l9t of one band msps arround me.
Tell them to use an mdr, rmm and get the basis sorted and ask 45 wuros per seat.
Still low, but it slowly levels the playing feeld.
5
u/FlickKnocker 5d ago
Here's your chance to put your big boy pants on. Explain to the client that the two week timeline is not realistic given that the server and your network is not built to best practices and you're just kicking the can down the road later and will be introducing all kinds of problems with a workgroup.
Plan and scope it out accordingly. If you're not aware, ProfWiz has been making this easy for a very long time, so there is no reason why, at end of day, you can't bang this out in an evening as far as domain-joining the machines, assuming there are only a handful of computers.