Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Our organisation has an AD; all users are in the one OU. I administer a section of the users. We have a bunch of computers that I only want to allow logon by users in a particular AD group (i.e. users in my section). How might I go about this?

share|improve this question
I hate to say it, but lumping all of your users into a single OU (especially when you have A. separate people managing separate groups, and B. different need for them) is not leveraging LDAP effectively. – gWaldo Aug 25 '10 at 13:21
unfortunately I don't control the AD, I'm in a sub-organisation that has to use whatever we are given from up on high. – askvictor Jun 14 '11 at 5:37
That is rather unfortunate. Might I recommend asking the AD admins that they make the changes for you? It could help make you much more effective. – gWaldo May 10 '12 at 23:25
Being restricted to using ou's as a filter criterion would also be ineffective, it does not scale well if you have completely unrelated groups of people (ie if you have ten buildings and ten departments that have people in a couple buildings each).... – rackandboneman May 17 '12 at 13:32

Group Policy depends on Active Directory, whether for security or normal policies, and therefore, it is crucial to understand Active Directory and its structure.

I would like you to go through this Microsoft KB article. I hope this will be useful for you, and the link I'm posting is for Windows 2000 as you did not mention for which Windows version you want to restrict.

For sake of time, search for a third party tool, as today there are many third party tools available which are made to manage Active Directory in an easy way.

share|improve this answer

I recommend breaking out your users by organizational function and likewise with your computers. Create a GPO to restrict access to those computers to only members of that function's OU.

You could also create a Security Group for the users and a security group for the computers and restrict access to the computer group to only allow the members of the users' group. (This can be done in any number of ways.)

share|improve this answer
The OP asks: "How might I go about this?" Your answer:"This can be done in any number of ways." Can you amplify your reply to illustrate one of these ways? I'm after the same answer and your reply is not thorough enough. – Sandy May 10 '12 at 20:07
While I don't provide click-by-click directions or the code or commands to do so, I do in fact tell him exactly what to do without dictating the method that the OP must implement. There are many ways to go about it. – gWaldo May 10 '12 at 23:22

You don't mention information about what version of Windows is in use, most likely because you don't have access to the boxes. I would ask the administrators to either setup GPO rules against an OU as gWaldo mentions and have them delegate administration of that policy to you or have them setup item-level targeting against a specific group of users that you are able to control.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.