I’ve got Win2k3 domain (running in Win2k mode) and several WinXP SP2 workstations that are configured to be multi-user PCs by using autologin accounts.
We want to use Group Policy and “mandatory” profiles to provide a consistent desktop for the PCs. Our software doesnt support true mandatory profiles, so we wish to use “Delete local cached copies of profiles” and “Prevent changes from propagating to server” machine GP settings. These PCs all will live in their own OU so that the highly-managed group policies do not apply to all PCs and users.
How can I prevent the autologin account from mistakenly being used on an unmanaged PC? We need to deny access to PCs not in the managed OU. We can deny access to the Computers container to combat new PC account problems, but not all PCs live there and I’d like to avoid a domain policy combined with block inheritance. We also have Citrix servers, and I don’t know if they log on locally or “through Terminal Services”.
Is there any other way to restrict an account to only access PCs in a given OU or group?