Locking down logon ability

It is dependent on what OS the workstation is running. Please be more specific. What type of Domain (NT or w2k) and what OS is running on the workstation.

Need more info.... Is the domain active directory, what is the OS of the workstations?

Actually, this is quite straight forward in Win2K.

Go to Control Panel | Administrative Tools | Local Security Policy | Security Settings | Local Policies | User Rights Assignment. There are actually two settings you can use. One is labeled "Deny logon locally;" the other is labeled "Logon locally."

One caveat to using either of these settings is that if either is already defined at the domain level, the domain setting will take precedence over whatever you define at the local computer level.

If it is available, using the "Logon locally setting would be the first choice. Enable the policy and then designate the user or group accounts that you want to have access.

If this setting is already defined at the domain level, you might be able to use the "Deny logon locally" setting by defining which groups or users you DON'T want to have access. You have to be careful with this setting. If a user to whom you wish authorize access is also a member of a group which you deny access to, the user will be denied access. In WinNT/2K/XP, an explicit "deny" takes precedence over all other permissions.

Hope this helps.

Sorry, I failed to mention that this applies to Win2k Pro on a Win2k Domain

If you have only one PC to lockdown. Use the Local Security Policy Snap-In to the MMC console and adjust the defaul security. The setting can be found in Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Log on locally. If you want to do more than one, create a separate OU in AD and move the computer accounts into it and create a new GPO and assign it to those machines. Let us know if this helps.

This question was auto closed due to inactivity