Windows Forum

Ask something
Discussion Locked

Disable Network Access for Specific User

0 helpful
14 replies

by a former member

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

On a Win2k Pro machine, is it possible to disable network access for a particular user, while allowing network access for other users?

I would like to consider setting up a less secure (shared) local account on some Win2k Pro machines, but only grant local access with this account--no network.

Is this possible? If so, how?

14 replies

by Former member

I've checked out group policy, and have had trouble finding an answer. Any clues on where to check in group policy?

by gralfus

You can disable or remove that person's network account in Active Directory (assuming this is on a domain). Then create a local account to allow that person to log on to just the one computer (selecting the computer as the domain).

If it isn't a domain, then things are a bit different. Let me know if it is a domain or not, and if there is more than one computer this person can use.

by Former member

This is on a domain. It is a local account that is being used. I have an account set up this way, with the same userid, on several computers.

While the local account may not give immediate access to the domain, there is still network access and, as a result, internet access.

I don't want this account seeing a network at all.

by sgt_shultz

how about, set up workgroup. only have one computer in it. have guy log into workgroup, not domain. have no rights in domain for user. or just rights to use printer...

by Former member

The computer should be on the domain, for the accounts that need not only network access, but domain access as well.

However, I don't want this account to see a network at all.

by Former member

There is a domain. The computers are on the domain.

The shared account is not a domain account. It is local.

The problem: When I log on locally with the shared account, I still see the network, though I am not on the domain. I still have internet access, etc.

The solution: When I use the shared local account, I would like the system to behave as though it could not use the NIC. When I log on with any other account (e.g. local admin, domain account, etc.), I would like to be able to access the network.

by the1faz

In group policy if you go to Computer configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignments

The very first option is allow access from the network. If you add the groups you want to have access you can keep other accounts like the one you have just created from having access to the computer from the network.

I hope this helps.

Jeff

by Former member

Great idea, except it's going the wrong way.

Instead of controlling access FROM the network, I need to control access TO the network.

Basically, when this local account is logged on, this computer won't be doing anything with the NIC.

by jason.hamm

The only possible solution I can think of would be to create multiple hardware profiles. Create one hardware profile that eliminates the NIC card for the user in question. Then assign this user the correct hardware profile that contains the disabled NIC.
To create multiple hardware profiles right-click on my computer and select properties and then the hardware tab. You should see an option for hardware profiles.

by Former member

Ok, I got the hardware profile creation part. However, I don't understand how you would assign hardware profiles to users.

Is that even possible, since hardware profiles typically get chosen at boot-up?

by fanku

lets assume that u have 4 pc.

so give IP add. 192.168.0.1 --pc no 1
so give IP add. 192.168.2.2 --pc no 2
so give IP add. 192.168.3.3 --pc no 3
so give IP add. 192.168.4.4 --pc no 4

by Former member

Ok, I have 4 pc's with the above addresses.

Now what

by tom

Here's a solution: Use devcon.exe

I use the following to disable my network card:

devcon disable =net pci\ven_8086

This disables the device matching class "net" (network adapters) and id "pci\ven_8086".

To get the id of your network adapter use the command:

devcon find pci*

Then locate the network adapter. You might have to experiment a bit.

To renable, simply use:

devcon enable =net pci\ven_8086

I think you need to be an administrator to do these. So if you're running this as a batch file you might have to use a runas script, e.g. runas professional (costs$) or the free kixtart runas encrypted solution. You can find descriptions on how to do this via a google search.

Hope that helps. It took me a while today to figure all of this out and I thought I'd add what I've discovered.

Devcon.exe is available as a free download from microsoft. See http://support.microsoft.com/directory/article.asp?ID=KB;EN-US;Q311272 for details. It's weird but apparently quite powerful.

Also see http://www.robvanderwoude.com/index.html - rob has tons of useful scripts, etc., including a description on how to use devcon with sample scripts.

Regards,
Tom Wolfe

This discussion is closed to new replies.