I have a Windows 7 Enterprise PC joined to a domain. Without using any domain level security, how can restrict a certain group of users (students) from logging in, but allow another group (staff) to?
-
Can you clarify 'Without using any domain-level security'?– Chris ThorpeApr 4, 2011 at 20:23
-
I mean not using a security group or OU to implement. I need a solution that I can install locally without going through group policy.– SandyApr 4, 2011 at 20:47
-
How are you going to identify the two groups of users that you mentioned, without using groups?– Chris ThorpeApr 4, 2011 at 23:57
2 Answers
I don't know what you mean by that "domain-level security" bit... But the correct way to do it is to put the Win 7 PC into its own OU in Active Directory and apply a Group Policy to that OU. In the Group Policy object editor, head to:
Computer Config -> Windows Settings -> Security Settings -> Local Policy -> User Rights Assignment and find the policy setting called "Deny Log on Locally." Add the Students to this group and they will be prevented from logging into the computer(s) to which the policy applies.
(stealing some text from Ben)
Assuming you at least have AD groups separating the two- students and staff, you can try the following:
Computer Config -> Windows Settings -> Security Settings -> Local Policy -> User Rights Assignment and find the policy setting called "Deny Log on Locally."
Add the NTAUTHORITY\Authenticated Users group if there isn't a Group Policy already taking care of this.
Then, explicitly add the AD staff group to the users group of the machine. (And remove any other groups that provide broad access to members of the AD.)
-
This solution is overly complicated and isn't scalable without more configuration. You would only need to deny log on to the group that shouldn't log in. To push out a policy that would require configuration changes to allow other users to log in is unnecessary.– HostBitsApr 8, 2011 at 0:08
-
Well, OP wants to work locally, and the solution, while requiring input to allow for additional users, would guarantee access only to users explicitly listed. Having to add users/groups to the deny list would be equally time consuming. It depends whether she wants to deny a group or only allow a group access. Apr 8, 2011 at 0:20
-
1