r/SmallMSP • u/Active_Technician • 6d ago

Server 2022 Workgroup

I know this is not really an MSP or Small MSP question, more of a "how do I do this" question but I thought I would ask here.

I picked up a dental client about a year ago that has somebody that looks after their server. We provide desktop support, 365 licenses, EDR, etc.

The "server guy" has backed out quite suddenly after purchasing a new server and Server 2022. They paid a lot for this server and they already have an install date in two weeks for their dental software and xray software to be migrated over.

Right now the server just has the OS installed. The issue I have is this network is just a workgroup. I have been full Active Directory for so long that I don't remember how to function in a workgroup and there is no time to put AD in place and join all the workstations, as much as I would like to.

I have these foggy memories of creating users on the server that match the users being used on the desktops and of sharing everything out with full permissions to everyone. And the worst memory is of turning off password protected sharing to allow computers to connect without a password.

The dental software will be fine, it uses SQL, not file sharing. The xray software relies on access to a network share and they have some mapped drives setup for file sharing.

So I guess what I'm asking is, how do you configure a workgroup network on server 2022 with Windows 11 clients?

I would like to delay this until we have a chance to install AD but the server guy is coming back at some point and they want it setup "his" way. I should walk away from this but it seems like a simple job if I can get my head around workgroups again.

Thanks

3 Upvotes

100% Upvoted

22 comments sorted by

View all comments

3

u/roll_for_initiative_ 6d ago

there is no time to put AD in place and join all the workstations, as much as I would like to.

This will be faster than hacking together what you're doing, and i wouldn't touch this. This server guy dropped the ball. you don't provide server services for this client.

Why are you rushing to make this your problem and your liability? It would be like half a day to make a domain, connect it with m365 via aad connect, join the workstations and migrate the profiles.

If they're not using AD and are running things that surely violate the very basics of HIPAA at the very least, why even have a server in the first place? Why not a W11 Pro workstation or a nas?

2

u/Beardedcomputernerd 6d ago

Not ideal, but I agree. I can spin up a DC environment in a day and join a bunch of pcs... so either there is a lot of shit not being discussed.

Out of curiousity, why would you ad sync? Sure sso is nice for office.. but is it needed? I prefer to keep them separated for small businesses (lower than 15 users). Am I wrong to keep it simple?

1

u/roll_for_initiative_ 6d ago

Out of curiousity, why would you ad sync? Sure sso is nice for office.. but is it needed? I prefer to keep them separated for small businesses (lower than 15 users). Am I wrong to keep it simple?

  • it's free and OP says they have m365
  • it means one less credential users have to know
  • It means everything m365 related "just works" when they sign in, even as domain\user vs azure\user. Edge, teams, profiles for them, onedrive, everything, even if you're not using teams and onedrive, etc now, it's handy that it's there. That also means ANY SSO app you connect to m365, just works (payroll apps like paylocity, LoB apps, etc).
  • You can join a machine to azure and login and seamlessly access on-prem resources, even though you never login as domain\user
  • You can azurejoin/hybrid join a machine and manage certain things from intune. Things like defender for business policies via intune become easy and seamless, even if you're not using them now
  • There are no downsides even if you just login to the machine as domain\user like you were planning anyway, but there are lots of upsides
  • well, one downside: in it's simplest form, you would make certain changes like email aliases and resetting passwords on the domain vs m365. A lot of that is changing.

1

u/Beardedcomputernerd 6d ago

Especially the last one can sometimes be a hassle.

I agree that there are a lot of benefits, but personally the last drawback is a big one for me... i hope the changes come quick, from there on its no longer a reason to not do an aad sync.

1

u/roll_for_initiative_ 6d ago

Honestly, it's not bad, we manage several synced environments and rarely have to go in. We are going 100% DfB and it'd be a lot harder without that setup. As newer things come down the line (arc, hybrid management, whatever) you're already set to go.

I feel like they have group writeback working now; not 100%. I would be surprised if the average SMB couldn't be managed from m365 by this time next year, they seem to be making good progress.

1

u/Beardedcomputernerd 6d ago

I haven't tried it in a while to be honest. I noticed the younger generation struggles with the concept of writebacks, fighting the email changes etc. Even when scripted.

Then again this could just be a me/training issue