Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to limit access for certain users based on their IP address in Active Directory 2008? For example a super admin would be able to access from anywhere but a lower level one would only be able to access from one specific IP.

share|improve this question
access to what exactly? You can limit anything deployed via Group Policy Preferences by IP address as well as a host of other targeting options. i.e. if you deploy an icon to users via GPP shortcuts, you can give users on one IP address or subnet one icon, and others another icon, or no icon etc... – Jordan W. Feb 10 '11 at 22:41
I second Jordan's question. What are we accessing? The domain? An application? – Christopher Feb 10 '11 at 22:46
I mean like accessing RDP or a share on the network. – MrGrant Feb 10 '11 at 23:03
A network policy server with conditions properties as part of the health and policy checks should allow this. – iivel Sep 27 '12 at 17:58

Yes and no. Out of the box the answer is no. You can however setup a system using NAC on AD groups, or an ISA firewall setup that allowed firewall level access to domain controllers based on user authentication from AD.

Doing this is an advanced configuration that requires a lot maintenance and administration and I would not recommend it. If you are an authenticated user you can query a lot of information from AD and this is required for proper functionality.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.