Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to protect one domain client machine from other domain users login except one domain user. ie my domain is ( Windows 2008 client machine is (

users name : test1 & test2

From this test1 only need permission to login to not for test2.

share|improve this question
up vote 1 down vote accepted

You can use Group Policy, either domain or local, to configure Deny log on locally right. This right is located under: Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Deny Logon locally

If the user also has remote access granted to these machines, you can deny their logon through Terminal Services. This right is named Deny log on through Terminal Services.

You may wish to maintain user groups instead of individual users. This can make updating the listing easier than editing domain/local Group Policy.

share|improve this answer

If you only want to do this for one machine, it's easy. You log into the individual machine and open local users and groups. On the command line, it's LUSRMGR.MSC. When the machine was joined to the domain, the users group automatically got "all domain users" as the default. Delete that and add the individual user that you want.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.