5

We've got a Win2K8 domain and we want to allow users in a specific group to logon only on specified computers in a specific groups. How can we do this?

2 Answers 2

7

Get the properties of their user account in Active Directory Users & Computers. Click on the Account tab. Click on the Log On To... button. Click on The Following Computers and then click Add and to add as many computers as you wish them to be able to connect to. Click OK to save the change. Works great.

2
  • Thanks, that works perfect, but I've edited the question, would you answer it again?
    – Ansari
    Mar 1, 2010 at 6:56
  • At that point, I'd prefer to put the computers they are allowed to log in to in their own OU and do this via group policy as suggested below.
    – icky3000
    Mar 1, 2010 at 8:18
5

I would do this with a group policy. It's much more scalable than the solution icky2000 suggested.

You would set a policy that denies local login to every machine (Computer Settings -> Security Settings -> Local Rights Assignment -> Deny Logon Locally)

Then set a higher precedence policy that removes the group from the above policy, this can be done with security filtering, or via different OU's for the restricted and non restricted computers. My personal preference would be for the Multi-container approach.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .