I'm dealing with a bit of an unusual remote work setup at my company. We have both full-time and part-time remote employees who need direct desktop access to our network to use our CRM, which isn't cloud-based and requires certain drives to be mapped. I'm thinking about providing laptops for remote work, allowing a generic local login, and locking that down through Intune so they can only access the VPN client and RDP to work on our server. This way, employees would effectively be using their laptops as dummy terminals.
Since some staff only work remotely a few times a month, I was considering a 'lending library' of laptops that they could check out if they know they'll be working from home. For hybrid users, they would have a dedicated locked-down laptop to carry to and from the office and would connect via VPN to access their work remotely. I want to make sure I'm covering all bases here. Am I missing anything? Is there a better way to manage this setup?
5 Answers
I’m not sure why you’d want to lock down the laptops so much. Just let them log in normally, then let them VPN into work and access resources as needed. I think locking it down complicates things unnecessarily.
Offering a generic login for laptops is not a great idea. Instead, create domain-joined laptops and use regular credentials. You can enforce necessary restrictions without going overboard on the lockdown.
We allow our remote workers to use laptops for regular tasks like Teams calls and email while handling heavier loads through RDP. Keeps things flexible.
It sounds like RDPing into a local machine could work, but for the long term, I'd suggest considering a virtual desktop infrastructure (VDI). It offers more stability without the complications of your current setup.
VDI can be quite expensive and might not be necessary, especially if your current system is functioning well. It depends on what your team needs.
Are you suggesting a VM for hybrid users who are in the office part-time? That could be an interesting approach.
We just provide laptops that allow users to VPN in and access their desktops. It’s straightforward and doesn’t require complicated setups. You might be making it more complex than necessary.
While using RDS is sensible if you need a workspace with mapped drives, I’m curious why you want that heavy restriction on the laptops. Just provide normal account logins with necessary access.
In cases where laptops are shared, it makes sense to have controlled access. But for most scenarios, a corporate identity should be sufficient.
Exactly, a strict lockdown limits usability. Users should be able to run necessary local apps while still accessing their work remotely.