Networks

Ask something
Question Locked

Restrict login on a specific computer

0 helpful
7 replies

by mreed3

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Have a Windows Server 2003 Std R2 Domain. Approx 100 computers and 150 users. Due to software requirements, all users must be admins. Several computers are mission critical and run Windows XP wi SP2. How can I restrict login on critical computers to a specific set of users and keep everyone else from being able to login to those computers?

7 replies

by mikedyne

I would guess would be to set up boot passwords on those machines you deem mission critical, and only tell those users who need them the password.

What about adding all the users that shouldn't use those PCs to a group in AD, then setting the NTFS settings of C:\ to DENY these users any access?

by cmiller5400

If you REALLY want to lock them out, in the local security policy of the PC to be restricted go to Computer Configuration, Windows Settings, Security Settings, Local Policies, User Rights Assignments, and then remove them from the Log on locally policy and add them to the "Deny Logon Locally".

by mikedyne

The advantages of your method over changing NTFS permissions? Just curious really, the more I can learn from here the better.

by cmiller5400

How are you setting up the users as admins? I hope not by adding them to the domain admin group! This should be easy because all you need to do is add the users to a domain group and only give that group admin access on that station. Remove the domain users group from the local users group on the pc's you wish to restrict.

by cmiller5400

Changing NTFS permissions doesn't disallow them access to the system, it just means they can't access the file(s).

Theoretically you could do that, but when the user logs in, they are going to see some error messages as they log in. It is even possible that the machine will lock up to the point that it will need to be rebooted hard. Why bother with tinkering with NTFS to "lock out" specific users when you can accomplish the same thing at the login screen? Restrict them in local security policy, and remove them from the local security groups.

by mreed3

The users are Administrators on the Local Machine, absolutely not on the Domain. I set up a Group Policy in the Domain restricting use of the Internet but it does not work.

This discussion is closed to new replies.