Windows Forum

Ask something
Discussion Locked

Restrict workstation logon

0 helpful
8 replies

by ravenseven

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I know in user manageryou can set which workstation a user can login, but there's enough for 8 workstations. I'm at a computer lab at school and we have 60 workstations and we need to restrict 20 of them for only graduate students and the rest of the workstations for any students. At last count we have at least 300 student accounts (roaming profiles) in an NT4 environment. The computers are NT4 workstations and we have 3 NT4 Server BDC's and 1 NT4 Server PDC (which will be eventually replaced by one of the BDC's). They all have Service Pack6.

8 replies

by kevin_b

One answer, although a bit cumbersome, would be to take one of the BDCs and make a new domain for the 20 pcs for grad students and then you can create trust relationships to give that domain rights to the resources on the original domain. Another idea is to put all the grad students in a group and only give that group rights to log into the 20 pcs you are talking about. You can take away rights for the rest of the users by taking them out of who can log into the pcs.

by jwirth

To bypass the 8-computer limit for specific users and computers:

1. Create a file on the Netlogon share called
"." for each authorized user and computer
account combination. You can do this by right-clicking an empty spot in the
right pane in Windows Explorer, pointing to New, clicking Text Document,
typing the user name, a period, and the computer name, and then pressing
ENTER. The file does not have to contain any data.

2. Edit the domain login script and add the following line at the beginning:

if exist %LogonServer%\Netlogon\%UserName%.%ComputerName% goto OK
REM use LOGOFF.EXE or SHUTDOWN.EXE here from Resource Kit

3. Add the following line to the domain login script at the point where the
script should continue execution after having verified the existence of the
user name/computer name file:

:OK

When the login script runs, it verifies the existence of a file on the
Netlogon share, substituting the current user and computer name for the
variables. Once this is complete, the script transfers execution to the OK
label designated after the GOTO command. You can place script commands
between these two lines to handle users logging in from computers for which
they have not been authorized.

4. Save the domain login script and then quit the editor.

.....Hope this helps

by stillatit

Put all grad students into a "grad" domain group.

On each computer you want to restrict, in Policies/User Rights, set "Log on locally" rights to include domainname\grad (and domainname\domain admins !!!) and take out of the list the general groups such as Everyone, Users, Guests, and Domain Users.

You can modify the policies on the various machines from your PDC using User Manager for Domains. For each computer, go to Users/Select Domain and type \\computername in the box to specify you want to edit the box named 'computername'. Make your changes, then go on to the next box.

Remember to test the first one before doing any others!

Good luck.

This discussion is closed to new replies.