Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Usually when I prepare a new computer to be used in our company I join it to the domain, then I go into "Users account" and then I add a domain user to the list of users allowed to connect to this computer. This worked well up until now since we never had more than one or two user per computer.

Now I want to configure a computer so it can be used by almost any domain users (in fact every users in a specific Active Directory Group).

I supposed there is a way to configure this in AD, but I've been searching on the web for the last hour and I did not find anything.

share|improve this question
I'm a little confused. By default when a computer is connected to the domain, the Domain Users group is added to the Local Users group, giving all users on the domain access to log on to a machine - can you expand a little bit more on how your AD is setup? – Zypher Feb 15 '12 at 21:32
What exactly do you mean by "users account"? I don't understand what you've done previously when adding computers to the domain (or why!) – Bryan Feb 15 '12 at 21:32
@Zypher... It does not work that way on my domain. Unfortunately I'm not the one who did the original setup, so I don't know why it does not work that way. In order to be connect to one of our computer I need to manually add the (domain) user to the list of users in "Manage users account" (I translated it myself from french, so it's possibly not called that in the original Windows version). – Mathieu Pagé Feb 15 '12 at 21:39
Are you talking about allowing users to connect (logon) locally or via RDP? – Bryan Feb 15 '12 at 21:46
The issue here as I see it is that what you're asking for is default behaviour in a windows domain. Now maybe you could produce a hack to "fix" what the current "hack" that breaks things is doing, but a better approach is to understand what changes have been made and reverse them in an orderly fashion. I know it sounds like I'm being pedantic, but I've seen issues where people only fix 90% of a problem because they didn't understand fully what had been done, things appear to work for a while, then no one can login one day, or you can't apply an important service pack 6 months down the line. – RobM Feb 15 '12 at 22:20

The standard behaviour in an AD domain is to automatically add the domain group "Domain Users" to the local group "Users" on each computer that is joined to the domain; this allows all members of "Domain Users" (which by default contains all user accounts in the domain) to log on to any computer in the domain.

If you have a non-standard setup which doesn't allow all users to log on to all computers, this can be due to two reasons: either your AD user accounts were removed from the "Domain Users" domain group, or that group is not member of the local "Users" group con your computers. You should check these two settings and fix them if they are not right.

share|improve this answer
I already checked that. It's not the case. – Mathieu Pagé Feb 15 '12 at 22:03
  1. Create a Security Group in Active Directory Users and Computers
  2. Go to the domain joined computer and add the AD Security group to the local group (Remote Desktop Users for example)
  3. Add the users (that need access to the computer) as members of the security group

If you have a lot of computers, and different "user roles", you might want to lay down a naming convention for these security groups that provide access to the different computers, like:

access - computername - role

So a Remote Desktop User group for a computer named COMPUTER1, has a corresponding AD Security group called: "Access - COMPUTER1 - Remote Desktop Users"

share|improve this answer

Instead of trying to configure this in the properties of the Computer, Why not use Group policies to modify the membership of the local Users and Administrator group on the workstation. Additionally, you can use policies to modify the Security policies like logon locally, logon from network, etc.

share|improve this answer

It sounds like you want to use Group Policy.

You should group your computer accounts into OUs (Organisational Units) and create a GPO (Group Policy Object) per-OU that specifies the "Users who can log on to this computer" attribute in the computer (not user) policy.

share|improve this answer

So you've been using the "log on to" properties of the user account to restrict the workstation that each user can logon to but now you want to allow members of a security group to logon to a shared workstation right?

I think you can grant a security group the "allowed to authenticate" permission on the computer object itself in AD and then remove "authenticated users", "Everyone", "domain users", etc if you want to restrict access to the workstation.

However, the problem is going to be that you've already specified a list of workstations on every user account to which that user is allowed to logon. I think you're going to have to end up using the computer account permissions to restrict things appropriately and remove your configuration under the user accounts otherwise you would have to add each shared workstation to the list of allowed computers on each users' account.

share|improve this answer
Not sure why you guys are nuking me. He's not asking for default behavior. He wants to restrict access to a workstation from a security group. That's not default behavior. Granted using GP would be cleaner and way easier to manage but this is one way of doing it. If you down vote, at least comment why so I can understand what I've said is incorrect. – Paul Ackerman Feb 16 '12 at 16:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.