In an active directory domain I'd like to have some PCs assigned to single people. For example on computer_a, the only people allowed to logon should be person_a plus the various administrators.
One common solution I found is to use the Logon Locally GPO, but this would require creating a new GPO and OU for each computer, as each computer would be assigned to a different user. Is there a better way?
One possible alternative I'm experimenting with is the following:
- use GPO to remove from the local users group the following accounts: NT AUTHORITY\INTERACTIVE and NT AUTHORITY\Authenticated Users
- add the user domain account to the local users group
This seems to work fine, but I'm worried about possible problems caused by the removal of the two special groups.
Is there a better solution?