up vote 1 down vote favorite
share [g+] share [fb]

I have a group of users that I'm setting up as test users. I want to make it so that no one can log onto the domain with these accounts, but they need to have active exchange mailboxes since this is what I am testing. I put all the test users in the same group. Can I set a security policy that will do this?

link|improve this question
feedback

1 Answer

up vote 2 down vote accepted

You can't disable users/groups from local login. What you can do is remove the "Users" group from the 'local login' privilege, then add back the rest of the people.

The settings are in Group Policy, Machine Settings, Security Settings, Local Policies, User Rights, Log On Locally. Be very careful you don't lock everyone out of everything (ie, apply this to an OU (or restrict it to a group) of just one computer, then test.

link|improve this answer
That works for a single machine, but how can I apply this to all the computers in the tree? – Jeremy Hutchinson Apr 21 '10 at 14:51
Open Group Policy Management Console from the Domain Controller. There will be a Domain Policy in there, right click and edit it (or a better practice is to add another GPO and link it). Be extremely careful though, it will apply automatically to all clients within minutes of changing the values (without having to save or close the GPMC, and assuming everything is working correctly). – Chris S♦ Apr 21 '10 at 19:01
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.