Sql-server – How to trust a non Domain PC over a VPN connected via a Domain Account for SQL Windows Authentication

active-directorycross-domainsql serverwindows-authentication

We are trying to enable a windows login to SQL Server from an untrusted laptop.

  • The SQL Server has been enabled to allow the domain account to login and browse the data
  • When a domain user connects to the VPN via domain PC (over the internet) they can connect successfully

So we have a guest on non domain pc non on a domain.

  • Local user logs on to PC
  • Connects to the VPN (using domain credentials)

when trying to browse the fileserver (same as SQL Server) they get:

  • The User is not allowed to login from this Workstation

when trying to browse the SQL Server they get:

  • Login failed. The login is from an untrusted domain and cannot be used with Windows authentication

I've done some reseach on the latter message but no links I found talk about our non domain to domain user.

Am I right in thinking that once a user connects to the VPN they impersonate the domain user?

Best Answer

Ok we have a solution.

In Active Directory User and Computers Snapin:

  • Select the User and right-click Properties
  • Select the Account Tab
  • Click the Log On To button
  • In the Logon Workstations dialog, add the name of the untrusted PC

Ok and apply as appropirate. Close the VPN, and restart the connection.

Related Topic