Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to just allow one user to login to a special computer in domain.
how can i do that ?

share|improve this question
up vote 2 down vote accepted

The are a couple of ways of doing this for a computer in a domain. You could create a GPO specifically targeting the one computer using the Group Policy Management Console, or you could do the same locally on the computer in question using Group Policy Editor.

If this is only ever going to be for one computer, you might be as well using Group Policy Editor (gpedit.msc) on the computer in question. If however this requirement might spread to other systems, it would make sense to do this via a Group Policy within active directory, as you can easily change the scope of the policy to apply it to multiple computers.

The method is exactly the same regardless of which method you choose, and involves you editing the policy to set the following option:

Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Allow Logon Locally.

Simply remove the users/groups you don't want to logon, and add the user you do want to logon back in. One thing to remember is that you need to make sure you don't remove 'Administrators'.

This process is also detailed here

share|improve this answer

On the computer in question, remove the domain users group and add the user you want to have access to the local Users group. Better still, create an Group and put the user in that group, then put that group in the local Users group.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.