After Hours

Ask something
Question Locked

Group Policy not accepting restricted users

0 helpful
5 replies

by jbritton

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have been working on restricting users from logging onto a certain computer. I researched using past TechRepublic and other blogs to help solve this issue. I am testing this using some of the replies I saw from these blogs. So, I created a new OU, put the computer in the OU I want to test with, created and linked its own Group Policy. In this Group Policy, I enabled deny logon locally and specified all the users I want to restrict from logging in. Well, I tested this by using a test user to log on with. It didn't work. Is it because I logged on locally with this test user in the past on the same machine and have a profile or should the Group Policy that now denies that test user take precedence and deny log on?
Also, I took away security permissions from both the OU and the computer object that might have a group that this test user may have rights to log in with. Does anyone have any suggestions? I have a need to deny a lot of users from certain machines. Any help would be appreciated.

Thank you....

5 replies

by wancona

You want to do a restrictions policy that allows everyone to log on accept for specific users to specific computers?

by wancona

I'm not sure if you created a security group or added the users names to the GPO.

Under the deny local logon policy, add all the users that you want to deny access.

Create a security group, not an OU, called "denied access" or something relevant to you. The membership would consist of the COMPUTERS that you want to deny some access on. The reason I wouldn't create an OU and move the computers to that group is, the existing polices that are already being applied to every computer may no longer work if you move them. Leaf objects (computers, users, and printers) are able to be a member of multiple groups, whereas they can only be a member of one OU, unless you want to have sub-OUs.

But anyways, I would then add the "denied access" security group to the policy under security filtering, and link the GPO to the appropriate location. You can either wait for the group policy to refresh, which I think the default interval is every 90 minutes, or you can go to each workstation and go to the command line and type gpupdate /force. You could possibly have to restart the workstation, depending on what the computer says needs to be done. That will do a fresh GP application.

by jbritton

wancona:
I appreciate your help. I don't deny it has worked for you but it doesn't seem to be working for me. What I do is I make a "test user" and make it a part of the group that I want to deny. I first tried to make an OU and call it "Restricted Use", put the computer in the OU, applied the GP. Then I tried your suggestion and that didn't work either.

So I am trying to applied the GP directly to the computer instead of a security group. I'll let you know how that goes.

Thanks,
Jack

This discussion is closed to new replies.