-3

How I can restrict access to the client! It's seems like everyone in the root domain and trusted domain can access the client, I would like to restrict access for specific AD groups.

6
  • 3
    How I can restrict access to the client! what are you actually asking? Are you asking how to limit interactive logins to specific computers?
    – MDMarra
    Dec 23, 2013 at 17:31
  • 2
    OP, don't mess with the special groups. Add it back like it was with net localgroup command.
    – Ryan Ries
    Dec 23, 2013 at 17:34
  • @MDMarra: yes, exactly what I want. By now everyone in the domain can log on. Dec 23, 2013 at 17:47
  • Why do you want to do this? What problem are you trying to solve with it?
    – MDMarra
    Dec 23, 2013 at 17:48
  • @MDMarra: We have two domain A and B (trustesd), where we use domain B to retrieve the users to domain A. The reason I will limit is because everyone in Domain B has access to the client, which should not be. This is because of accessibility control of applications and only a certain group can access, etc. Dec 23, 2013 at 17:56

1 Answer 1

1

Best way to tackle this is with group policy IMO.

Deny Local log in, group policy: http://technet.microsoft.com/en-us/library/cc957048.aspx

You could just remove "users" from the "allow log on locally" group.

If you're only talking about one computer, the easiest way to do it would be to do the following:

  1. Create an ad group
  2. edit the computers local gpo a. remove "users" from the "allow logon locally" b. add the group that you created in ad

If you're talking about multiple computers

  1. create an ad group
  2. put the computers into an OU
  3. create a GPO and apply it to the OU.
4
  • see my edit, let me know if that clears it up. Dec 23, 2013 at 18:54
  • Without any issue? I couldn't promise that. You need to understand the way GP works and what the policies are doing. what are you concerned about exactly and what are you doing specifically? Jan 1, 2014 at 23:34
  • This solution works very well, but remote installation does not work even if you Enable PSRemoting on client. (The administrator group are also added in "allow logon locally"). Is there any other solution? Feb 13, 2014 at 9:39
  • i'm not sure what to tell you. I've provided the info that i know and that has worked for me. Feb 13, 2014 at 14:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .