Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a small group of desktop servers and I do not want anyone to be able to log on to them locally except for administrators.

We have a Windows 2003 AD and the servers are running Windows 7 Pro.

I know that I can:

Create an OU in AD with said computers, and assign a Group Policy to that OU. Then, in the Group Policy Editor, go to: Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow log on locally and delete all groups/users except for Domain Administrators, Remote Users, and Administrators?

Is it better to do this this through Group Policy, or configure this on each machine?

share|improve this question
Please explain your definition of "Log on locally". If the user is a domain user then they won't be able to log on locally to the computer anyway. The exception being if they lose access to the DC, but their credentials are cached. But even so, they'd still be logged on as a domain user. – Dan Feb 14 '12 at 16:05
Just to be clear. A server running Windows 7 isn't a Server at all. – MDMarra Feb 14 '12 at 16:07
correct, a win7 machine is not technically a server but it is used as one by servicing images in a PACS system. It runs 24/7 and no one is suppose to use the computer, except I noticed on the logon screen someone has been using it. – Logman Feb 14 '12 at 16:18
"Log on locally" is anyone sitting in front of the computer. There are only admin local user accounts, so I need to stop domain users (non-admin) from accessing the computer. – Logman Feb 14 '12 at 16:20
up vote 2 down vote accepted

The way that you mentioned is the best way to do this.

You can configure this on each individual computer, but there's no benefit. Doing it via GPO is much more scalable.

share|improve this answer
I noticed after doing the above, the computers host name does not resolve anymore, but the ip does. I can not even ping the computer using the host name... side effect? – Logman Feb 14 '12 at 20:43
No. I used a similar method to lock down wireless guest accounts that authenticate against AD with no adverse effects. You must have some kind of non-standard config. – MDMarra Feb 15 '12 at 0:21
resolving the host name worked the next day. – Logman Feb 16 '12 at 12:27
@Logman Sounds like you have bad DNS scavenging settings or something completely unrelated to this policy and the two coinciding was a coincidence. – MDMarra Feb 16 '12 at 13:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.