Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have active directory and several clients joined the domain. Every user logs to the computer with domain user and password credentials.

I need the users only to be able to log in to the specified computer and no other computer.
This computer is monitored.

If someone discovers the password (or malicious worker who knows the pass) he can add another computer with the computer name, user and pass, and the joining process will allow him to join the computer. He can do a lot of problems while discovering that we have illegal login.

My application uses wcf (windows communication foundation) and the service is hosted in iis. It uses message authentication with integrated windows authentication.

My question is how can I protect the application only to be authenticated from the computer I like (pc at work, it is not allowed to use it outside the work place, by workplace I mean several offices geographically alocated)?


share|improve this question
You seem to be asking two questions here. If so, please split the second one off to a separate question. – Chris Thorpe Oct 10 '10 at 6:56
up vote 1 down vote accepted

It sounds like you want to restrict an AD user to only log in from a single computer?

Within the user properties in AD, on the account tab, you can bind that user to a specific computer account.

share|improve this answer
Also, you can work around the problem of users being able to join new machines to the domain, by applying GPOs to the 'computers' OU in AD, and treating it as a jail. So set a GPO on that OU that says 'only domain admins can log into machines in here'. User joins machine then finds out they can't log into it anymore. – Chris Thorpe Oct 10 '10 at 6:52
Thank you very much. – darko petreski Oct 10 '10 at 9:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.