I want to just allow one user to login to a special computer in domain.
how can i do that ?
The are a couple of ways of doing this for a computer in a domain. You could create a GPO specifically targeting the one computer using the Group Policy Management Console, or you could do the same locally on the computer in question using Group Policy Editor.
If this is only ever going to be for one computer, you might be as well using Group Policy Editor (
The method is exactly the same regardless of which method you choose, and involves you editing the policy to set the following option:
Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Allow Logon Locally.
Simply remove the users/groups you don't want to logon, and add the user you do want to logon back in. One thing to remember is that you need to make sure you don't remove 'Administrators'.
This process is also detailed here
On the computer in question, remove the domain users group and add the user you want to have access to the local Users group. Better still, create an Group and put the user in that group, then put that group in the local Users group.