Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to disable all users except your user from logging into your PC when you're part of a Windows Server 2008 Active Directory domain?

share|improve this question
up vote 3 down vote accepted

If you're blocking it through the AD, you're going to need to go to the "Active Directory Users and Computers", select the record for the computer in the domain, and go to the "Security" tab and remove everyone you don't want to have access.

Might also want to go to "Local Security Settings -> User Rights Assignment" and make sure "Access this computer from the Network" is right, and "Allow logon though terminal services" as well.

share|improve this answer
Umm... your first suggestion isn't what I would recommend. Why mess with the ACL on the computer account when your second option is easier, safer, and the more preferred method, although you want to set the "Allow log on locally" user right as well. – joeqwerty May 28 '10 at 17:20
+1 for using GPO to control the local security settings. – Doltknuckle Jun 4 '10 at 17:08

You can add your user account to the "Users" local group, then remove the "Domain Users" AD group from the local users group.

This won't keep admins out though.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.