Windows Forum

Ask something
Discussion Locked

Deny users access to certain PC's

0 helpful
5 replies

by leighx

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am trying to deny access of certain OU's or Users (2,500ish of them) to specific computers. I work within a school and I'm trying to stop students accessing the network via teachers laptops. I know I can do this within AD+C but can only specify what computers they CAN logon to. It looks as if I cannot use wildcards or OU's as computer names and I am not willing, (maybe just lazy) to input over 800 machine names. all the laptops are named LAP-. I cannot find in the Domain GP anywhere where I can dis-allow logging on from specific users,(maybe looking to hard) or a quick way to only allow then on all the others.
Any help greatly appreciated

Many Thanks

5 replies

by toivo talikka

It sounds as if you need the IF MEMBER facility in your system:

http://www.microsoft.com/windows2000/techinfo/reskit/tools/new/ifmember-o.asp

You can then test the user's group membership in Students or Teachers before allowing the login to proceed and drive mappings to be allocated.

Alternatively, you could install KiXtart from http://www.kixtart.org and include in your login script something like this:

IF INGROUP("Students")
IF SUBSTR(@WKSTA, 1, 4) = "LAP-"
LOGEVENT(2, 1, "Unauthorised login", "", @USERID)
PLAY FILE "Ding.wav"
MESSAGEBOX("Gotcha!", "Warning", 16, 60)
LOGOFF(1)
ENDIF
ENDIF

by leighx

Thanks Toivo, I used the Kixtart. Took me a while to get it sorted but hey!!!

by leighx

Thanks Toivo, I used the Kixtart. Took me a while to get it sorted but hey!!!

This discussion is closed to new replies.