General discussion

  • Creator
    Topic
  • #2316251

    how to assign group log on locally right

    Locked

    by greg ·

    I want to create a group in active directory for each server in my domain and then give each group the right to log on locally to that specific server. I need to be able to restrict who can log on to the server console to Administrator and the specific group for each server. I think this is done the group policy settings on the local machine but I am confused about how domain or OU policy settings might override the local settings. Do I need to create a new OU and move all of the servers into it first?

    I am looking for specific instructions or links to detailed articles.

All Comments

  • Author
    Replies
    • #3380370

      Reply To: how to assign group log on locally right

      by grzegorz_osimowicz ·

      In reply to how to assign group log on locally right

      This can be tricky. By default any domain user will be able to log on to any computer (workstation or server) as long as it is not a DC.

      If you wanted to restrct the ability to a given group only you would need to create an additional OU and move the limited-acess servers into the OU.

      You would then need to create a new GPO, assign it to the new OU and set the correct user rights:

      The new GPO > Computer configuration >windows settings > security settings> Local policies >User Right Assigment

      > deny logon locally > all the groups you do not want to have local access to the server .

      Regards,

      Greg Osimowicz
      MCSE, A+, Network+

    • #3380053

      Reply To: how to assign group log on locally right

      by greg ·

      In reply to how to assign group log on locally right

      The first answer is good but I am hoping for additional insight or tips that might make this easier. I do not relish the idea of maintaning deny lists because they can get out of date quickly.

      All sincere suggestions will be accepted.

    • #3380052

      Reply To: how to assign group log on locally right

      by greg ·

      In reply to how to assign group log on locally right

      Point value changed by question poster.

    • #2744341

      Reply To: how to assign group log on locally right

      by greg ·

      In reply to how to assign group log on locally right

      This question was closed by the author

Viewing 3 reply threads