Windows Forum

Ask something
Discussion Locked

Restrict computer access

0 helpful
7 replies

by elbmag 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We have an active directory domain with multiple OU's set up. We have an outside vendor who needs to access 5 computers on our network via remote desktop. I want to set them up with a domain username and password that only allows them to access these 5 computers and nothing else.

Not really sure how to go about this and I will admit this is not really my "normal" area of expertise, but I've been asked to get this setup.

Any help would be greatly appreciated.

7 replies

by lowlands

It kind of depends on your AD setup. But you could create his account, add it to a specific group and remove the account from "domain users". If you don't give a lot off access left and right to the everyone group, you should be ok. You can then give the group (or user) access to the 5 machines explicitely

by jim.myler

The problem with creating a domain user for this access is that depending on how many servers that you have and how much the everyone group pervades your public objects this can become a management nightmare. A local user cannot access domain security restricted objects. Create a local user on each machine. Then give the local user rights to remote access. In this way they will not have any domain access. This of course depends on what functions they need to perform on the machine. Keep the user name and password the same on each to simplify your vendors access. Do the same to any apps or files or shares on the machines to allow access to domain restricted objects on each machine.

by p.j.hutchison

Create an AD account for the Vendor, open the properties of the Vendor's account, click on Account tab and then 'Log On To' button. Enter names of the 5 PCs the vendor is allowed to logon to!

by elbmag

Lowlands, I appreciate your response. I believe what you said would work; however, in my case I believe P.J's response is easier to setup and make work (for my environment at least).

Jim your answer would work; however, the user (vendor) is requesting domain rights so they can have a similar user environment to simulate user problems.

P.J. I really appreciate the simplicity of setting up this user in your scenario.

Thanks to everyone for their response.

This discussion is closed to new replies.