Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i have 4 different types of department IT team, Development, Training, marketing. I want IT team to have full permission to login to any machine on any department. other users on other department only has permission to login in their own department. my server is 2008 server

share|improve this question
You need to fill in some more details here. What exactly are you looking for? What do you have? – Bill Weiss Apr 5 '10 at 20:04

You should be able to use security groups for this.

Create a security group under Computers for each department.

Then create an equivalent security group under Users (or whichever OU your users live in).

Make sure that all of the departmental computers belong to the department computer security group, and make sure that all of the people belong to the department user security group.

Then go to the properties on the user security groups, click the Account tab, click "log on to", select "The following computers", type/find the computer security group appropriate for that group. Click OK.

Do that for each, and that should limit each user to only being able to log into their appropriate computers.

share|improve this answer
your doing this in Group Policy rite. – jason Apr 5 '10 at 20:46
No, just in Active Directory Users and Computers – Matt Simmons Apr 5 '10 at 23:49
thx will check it out – jason Apr 6 '10 at 18:02

You might try using Restricted Groups in Group Policy instead:

For this to work, I believe you will need to create an OU for each department's computers in addition to security groups for each department's users. I would create an OU called "Workstations", and create child OUs in the Workstations OU for each department. Then I would probably create a GPO for each OU to restrict which security groups are members of the Users group.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.