Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Windows 7 Enterprise PC joined to a domain. Without using any domain level security, how can restrict a certain group of users (students) from logging in, but allow another group (staff) to?

share|improve this question
    
Can you clarify 'Without using any domain-level security'? –  Chris Thorpe Apr 4 '11 at 20:23
    
I mean not using a security group or OU to implement. I need a solution that I can install locally without going through group policy. –  Sandy Apr 4 '11 at 20:47
    
How are you going to identify the two groups of users that you mentioned, without using groups? –  Chris Thorpe Apr 4 '11 at 23:57

2 Answers 2

up vote 4 down vote accepted

I don't know what you mean by that "domain-level security" bit... But the correct way to do it is to put the Win 7 PC into its own OU in Active Directory and apply a Group Policy to that OU. In the Group Policy object editor, head to:

Computer Config -> Windows Settings -> Security Settings -> Local Policy -> User Rights Assignment and find the policy setting called "Deny Log on Locally." Add the Students to this group and they will be prevented from logging into the computer(s) to which the policy applies.

share|improve this answer

(stealing some text from Ben)

Assuming you at least have AD groups separating the two- students and staff, you can try the following:

Computer Config -> Windows Settings -> Security Settings -> Local Policy -> User Rights Assignment and find the policy setting called "Deny Log on Locally."

Add the NTAUTHORITY\Authenticated Users group if there isn't a Group Policy already taking care of this.

Then, explicitly add the AD staff group to the users group of the machine. (And remove any other groups that provide broad access to members of the AD.)

share|improve this answer
    
This solution is overly complicated and isn't scalable without more configuration. You would only need to deny log on to the group that shouldn't log in. To push out a policy that would require configuration changes to allow other users to log in is unnecessary. –  Cheekaleak Apr 8 '11 at 0:08
    
Well, OP wants to work locally, and the solution, while requiring input to allow for additional users, would guarantee access only to users explicitly listed. Having to add users/groups to the deny list would be equally time consuming. It depends whether she wants to deny a group or only allow a group access. –  Soursprite Apr 8 '11 at 0:20
1  
In a Windows Enviroment, Explicit Deny's always win. –  Zypher Apr 8 '11 at 0:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.