Windows Forum

Ask something
Discussion Locked

Controlling PC access by OU

0 helpful
6 replies

by brandon.aiken

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I've got Win2k3 domain (running in Win2k mode) and several WinXP SP2 workstations that are configured to be multi-user PCs by using autologin accounts.

We want to use Group Policy and "mandatory" profiles to provide a consistent desktop for the PCs. Our software doesnt support true mandatory profiles, so we wish to use "Delete local cached copies of profiles" and "Prevent changes from propagating to server" machine GP settings. These PCs all will live in their own OU so that the highly-managed group policies do not apply to all PCs and users.

How can I prevent the autologin account from mistakenly being used on an unmanaged PC? We need to deny access to PCs not in the managed OU. We can deny access to the Computers container to combat new PC account problems, but not all PCs live there and I'd like to avoid a domain policy combined with block inheritance. We also have Citrix servers, and I don't know if they log on locally or "through Terminal Services".

Is there any other way to restrict an account to only access PCs in a given OU or group?

6 replies

by brandon.aiken

Just to emphasize: Allowing the autologin account to access the network from an unmanaged PC would allow the roaming profile to be changed. Since this would change the desktop on some 30 or 40 PCs for each login, the impact of just one unmanaged PC is fairly high.

by howie.erickson

The easiest way to do this, is to take the autologin user accounts and set their properties to only log in to the designated computers.

Hope this helps!
Howie

by brandon.aiken

You mean the "Log on to..." setting that uses NetBIOS names? What happens when a computer is deleted from AD? Is it automaticaly removed from that list? I can't think that it is.

Part of the problem is that the people who manage AD and the people who support the PCs are different teams. The PC Tech have never had to deal with configuring PCs in AD, so it needs to be as idiot proof as possible. If one of those PCs goes down, the AD computer account gets deleted and re-created when it gets joined to the domain which (I'm certain) moves it back to the Computers container.

by bfilmfan

The true answer here is to remove the security permission from the workstation admins to remove a computer or user object from the domain, since the risk is so great.

The other true answer is to train your workstation adminsistrators in Active Directory and tell them to stop deleting computer objects.

You are correct that the workstation object will indeed move to the detault Computers container and you cannot place a GPO on a folder.

by brandon.aiken

The workstation admins are the only ones who manage PCs, and the AD admin team refuses to give workstation admins rejoin permissions -- actually I think they're missing the disjoin priviledge, since that action never succeeds, either. If they re-image a machine (such as when a PC breaks down) they *must* delete and recreate the object because that's the only thing they're allowed to do. This is, of course, really poor planning on Ad admin team's part. (I had nothing to do with this decision, and don't support it.)

It seems most likely that the script that adds the autologin registry changes will also automatically warn the workstation admins to double check that the PC is in the AD OU.

Thanks for the help.

This discussion is closed to new replies.