Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We've got a Win2K8 domain and we want to allow users in a specific group to logon only on specified computers in a specific groups. How can we do this?

share|improve this question

Get the properties of their user account in Active Directory Users & Computers. Click on the Account tab. Click on the Log On To... button. Click on The Following Computers and then click Add and to add as many computers as you wish them to be able to connect to. Click OK to save the change. Works great.

share|improve this answer
Thanks, that works perfect, but I've edited the question, would you answer it again? – Ansari Mar 1 '10 at 6:56
At that point, I'd prefer to put the computers they are allowed to log in to in their own OU and do this via group policy as suggested below. – icky3000 Mar 1 '10 at 8:18

I would do this with a group policy. It's much more scalable than the solution icky2000 suggested.

You would set a policy that denies local login to every machine (Computer Settings -> Security Settings -> Local Rights Assignment -> Deny Logon Locally)

Then set a higher precedence policy that removes the group from the above policy, this can be done with security filtering, or via different OU's for the restricted and non restricted computers. My personal preference would be for the Multi-container approach.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.