1

I currently have a user DOMAINJOINER (located in the WIN7Support OU) which I use to deploy Windows 7 machines. This user can Create and Delete Computer Objects in the WIN7Computers OU, that's about it as far as access is concerned but he's also in Domain Users group. When the new Windows 7 computers boot (via custom image) they use DOMAINJOINER credentials to join the domain. When the computers join the domain they're added to the WIN7Computers OU (this is set in the custom image).

The WIN7Computers OU will hold all the Windows 7 machines.

In one of our GPOs I have a setting that does the following:

Deny Log on as a batch job: domain\DOMAINJOINER Deny log on locally: domain\DOMAINJOINER Deny log on through terminal services: domain\DOMAINJOINER

unfortunately this GPO can only be linked to the WIN7Computers Ou and not the WIN7Support OU where user DOMAINJOINER resides.

My question is, how can I deny DOMAINJOINER from logging on interactively to any computer in the domain yet allow the custom image to continue to use DOMAINJOINER credentials to allow computers to join the domain?

1
  • IIRC domain users cannot log on to a desktop via physical access or RDP by default anyway. If that's changed for your network then this is a pretty serious issue and you need to figure out what has been changed and fix that rather than hacking around with settings on individual accounts.
    – Rob Moir
    Aug 28, 2014 at 20:48

0

You must log in to answer this question.