Inhouse intruders

Don't let your workers bring their personal computers into work, there should be a policy to stop this. Especially if your general Standard Operating Environment is NT and they are violating this.

Being assigned an ip address and having access to either the domain or the computers on the domain are two seperate things.

In and NT environment (including NT Workstations) users have to have been granted access through their domain account or the local (machine) account to peruse your stuff. permissions are specifically metted out using the 'user manager'. So...

Go to the 'user manager' under administrative tools, select 'policies', 'User Rights'. In the drop down select 'Log on locally'.
Remove everyone (and groups) except yourself.

Next select 'Access this computer from network' and remove everyone except yourself.

Now you are the only one who can access that machine.

Incidently, while you're there click on 'Audit' and check the appropriate items.

You can check the security logs from timeto time to keep track what has gone on.

NT's great, isn't it ?

Even with a NT workstation you can hookup a computer. I have testit and besides I download a program and run a program as a guest and got all the usernames and password. That's why I'm looking for a solution for this.

Dude, It makes no difference who gives whom all of their account information including user id and password.

If under 'policies' and 'User Rights' in the 'User Manager' you have removed all accounts except your own account for permissions under the heading, 'Access this computer from network' and 'Log on locally'...

..then yours is the only account that can access that machine. Period.

You can set up a dynamic static Ip Scope. this is where you reserve ip address based apon the users MAC. this way the users still have dhcp enable but they will only get the Ip address that you have associated with there MAC Address and if there mac address is not specified it will not give you a IP Address. IF you have a Cable modem this is what they do. to prevent anyone from just connecting to there network and getting a IP Address. So you need to make sure that every Ip address in yourscope is reserved buy Mac address if it is not any one can pick up that IP..

Be careful about removing user rights such as logging on to computer or accessing computer from the network. You may wind up locking out legitimate access. Do disable the Guest account and groups. Another trick is to rename the 'Administrator' account - harder to crack if you ahve to guess which account you need to crack. But, be careful with any services logging on as 'administrator' - you'll have to update each account. Make sure comments in User Manager do not give away domain admin priviledges. In the final analysis computer security only keeps honest people honest. The dishonset users you'll have to track down and discipline IAW corporate policy.

Have you tried the logon to box in user manager. Here you can specify which computer(s) a user can log on to. If you then hide the network nieghbourhood icon they will not be able to find the pc identification and pass it on to others.
This shouldwork.