This question potentially sits somewhere between ServerFault and DBA Admins but the Domain element of this as led me to put it here.
We have been developing an SOA product and are thinking about different deployment scenarios for our managed servers at client's office. The trigger for this question was discussion about using SQL Server FILESTREAM which requires integrated security
SQL logins will not work with FILESTREAM containers. Only NTFS authentication will work with FILESTREAM containers. FILESTREAM MSDN
At the moment FILESTREAM is the only reason we have for using Integrated Security which makes the potential requirement to deploy Domain Controllers (and their redundancy requirements) to the manager servers unappealing.
I've had a look around and there's a few questions suggesting that you can use WORKGROUPS with Integrated Security.
Integrated Security (SSID?) in a no-domain...
My question is, is there a recommended practice for the scenario described above? Should we give WORKGROUP security a go and see how we get on or is there a reason that's a big no no and we should either use a domain or not use FILESTREAM?