Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to prevent users in my team from using some passwords? I know that the easy way to tackle this is to change the password, but would it be possible to ban a computer which is joined to the domain to use that password?

So if my colleague logs onto a machine called ABC, it cannot use an account, because I have banned the machine ABC from using that account (somehow) in AD.

The user accounts for my colleagues are on another domain and there is no trust at all between the main domain where user accounts are stored and our team-specific domain (which holds the account that I want to ban my colleagues from using).


share|improve this question
When you say "no trust at all" do we assume you mean on the human side? – John Gardeniers Aug 9 '10 at 23:09
Are you talking about passwords or accounts? – David Z Aug 9 '10 at 23:19

If you have active directory there is a setting on the account tab that says "log on to". By default accoutns can log on to all computers, however that setting allows you to specify what computers a given account can log on to.

If yuo cannot do that you can also deny the users the ability to logon using local or domain group policy.

share|improve this answer

Again, as everyone here says, you keep confusing account and password. If I understand you correctly, you want to deny people from logging onto a computer with that account. If you want to make sure no one can log on to the console, but you can still use the account to do remote admin, AFAIK this is exactly what deny local logon is for in Security Policy. You can do this on a per computer basis. In either the local Group Policy client (gpedit.msc) or Group Policy Management Console (gpmc.msc) if you want to enforce this for a group of computers, say important servers. Follow the following path.

Computer Configuration -> Windows Settings -> Security Settings -> User Rights Assignment -> Deny logon locally

Since the wording is confusing, I cannot really tell if this is what you are looking for or not. Done properly, you could probably get the account to work properly remotely for you and people with, let's say, RDP privileges, but Joe Schmo who tries to log on locally with said account would walk away confused when he is refused time and time again. I have done it in some places myself.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.