Networks

Ask something
Question Locked

limit local users

0 helpful
12 replies

by naderihadi

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi

I have setup a server with a domain controler. There are also some 20 workstations connected to it.
Recently I descovered that some users login localy to the computers and bypass login in to the DNS. This cause me lot of hassle by finding out that they have installed unauthorised softwares.
How can I restrict them of not being able to login locally. I do know that its in computer configuration of GPO, but somehow it doesn't seems to be working !!!!!

Could someone step by step tell me how it works.

Thanks

12 replies

by shasca

When you say connected to domain in your question, does mean that you Joined them to the Domain too. Joining these PC's to the Domain will give you total control of every aspect on these individual PC's through Group Policies. You did install Active Directory Too right?

This would be a good time get an Administrators guide to help you manage your new Domain.

You are the keeper of the keys once the Network is aetup properly

by naderihadi

Yes the workstations are joined to the network. Users can log in with their user accounts. But the problem is that they have the option of (This computer) in login which I want to eluminate.
Could you just tell me how that works.

Thanks

by shasca

The only time I have seen the option to login Workstation only is on a hybrid network in which the PC's have the Netware client on them. If these PC's are connected, and authenticating to the Domain as you say, then once the PC's have created cached credential those would be used to log in local. That would only happen if they were away from the network. Joined PC's need a Domain account to login to the Domain. At which point any applied Group Policies would load and lock down the localsettings you desire.

I don't think you have them fully joined just attached.

by jim.turnbull7

Local Computer Policy> Computer Configuration> Windows Settings> Security Settings> Local Policies> User Rights Assignment>

Deny logon locally

Add desired user or group

by naderihadi

What I have done is that I did manage to restrict users through the GPO in

Local Computer Policy> Computer Configuration> Windows Settings> Security Settings> Local Policies> User Rights Assignment> Deny logon Locally, but the problem is that some clients know the local administrator password, and that i cannot restrict administrator in the above policy (even if its local administrator).

by shasca

In the Computer Configuration in your GPO
Expand Windows Settings
Expand Security Settings
Expand Local Policies
Select User Rights Assignment
You want Deny Access to this computer from the network
Select Define these policy settings.
Then you can add Administrator.

by ic-it

password. If it has been comprimised then you have no control until you change it.

by 1bn0

Windows XP will install with no administrator password.

This allows any competent user to access the local administrator account and do whatever they want to the machines.

You need to set the local machines administrator accounts to a password that is not known to the users. Maybe someone else can advise you on a method to do this via logon scripts or group polocies.

Next you need to disable (or delete , second option) the local user accounts these users have been using or have created. You may want to initially disable them as they may have data stored under the local profile that you will have to maintain access to.

If the user has been using the local profile exclusively you can copy the local user profile to the domain user profile to transfer there documents and settings to their domain profile. This is why you should disable rather than delete the lcoal rpfoile. Otherwise their data will be gone and they will be even less appreciative of losing their local admin access.

Have them log on to windows under their domain account to create the profiles directories.

Restart the computer. Windows will not let you copy the profile of a recently access user.

Log on under an admin account, local administrator or a domain admin account.

Open System Properties, Advanced tab. Click on the settings button under "User Profiles.

Here you will see a list of all of the profiles stored on the computer , both domain and local.

Select the local profile of user you want to copy, shown as localmachine\username and click on the Copy to button.

Click on Browse and move to the Documents and Settings / Users (vista) folder auntil you have located the Domain Profile folder for the user. If the local username and the domain username is the same you will see two folders smithj and smithj.domainname the first would be the local profile you have already selected in the Systems Properties list. The second would be the domain profile folder you want to copy to. Higlight the folder and click on O.K.

Back in the Copy To window click on change and enter the users domain username. This will set the permissions on the user profile from the local account to the domain account so they can read nad write to the files after they are copied. Let windows complete the task.

A little long winded but I wanted to make sure I covered what is required to save their data before you deleted it all.

by naderihadi

Thanks for your beautifull explanation. The main part which is my concern is how can i disable the (This computer) option in the login bit. You did mentioned disable it, but how?

Cheers

by 1bn0

Start Menu | Programs | Administrative Tools | Computer Management

Or right click on a My Computer icon, on the desktop or on the Start Menu and Select "Manage.

Or Start | Run | compmgmt.msc (and click Ok)

If you have Domain Admin rights you can run the console from your desktop and connect to the workstations remotely.

Open Computer Management on your workstation.

Right click on Computer Management (Local)
Select "Connect to another computer" from the context menu. Enter the name or IP of the workstation you want to manage and click OK.

In the tree open Local Users and Groups / Users. Select the account you want to disable. Double click it and check the "Account is disabled" box and click OK.

The account is no longer able to log on.

You can also use this method to change the local administrator account password , although one machine at a time can be time consuming. Do not use this method if you are encrypting the local hard drive data as the encryption is tied to the account password. You have to be logged on under the appropriate account to change the password of an account using encryption.

(Edited for spelling)

by arreguin

Maybe they have the old password, before you install the domain controler,and maybe its a pass with administrator rights, you should to change all password of administrator of those PC's, create an excuse to them that you are goint to update something, and change the pass, give them only The login an pass of your domain an then you must be sure taht all your users only have user right's in you r domain

This discussion is closed to new replies.