How I can restrict access to the client! It's seems like everyone in the root domain and trusted domain can access the client, I would like to restrict access for specific AD groups.
1 Answer
Best way to tackle this is with group policy IMO.
Deny Local log in, group policy: http://technet.microsoft.com/en-us/library/cc957048.aspx
You could just remove "users" from the "allow log on locally" group.
If you're only talking about one computer, the easiest way to do it would be to do the following:
- Create an ad group
- edit the computers local gpo a. remove "users" from the "allow logon locally" b. add the group that you created in ad
If you're talking about multiple computers
- create an ad group
- put the computers into an OU
- create a GPO and apply it to the OU.
-
-
Without any issue? I couldn't promise that. You need to understand the way GP works and what the policies are doing. what are you concerned about exactly and what are you doing specifically? Jan 1, 2014 at 23:34
-
This solution works very well, but remote installation does not work even if you Enable PSRemoting on client. (The administrator group are also added in "allow logon locally"). Is there any other solution? Feb 13, 2014 at 9:39
-
i'm not sure what to tell you. I've provided the info that i know and that has worked for me. Feb 13, 2014 at 14:45
How I can restrict access to the client!
what are you actually asking? Are you asking how to limit interactive logins to specific computers?net localgroup
command.