Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to setup a limited account for an outside company in active directory. They need to connect to one server to setup their software. I created a new group called "Limited Access", made that their primary group, and removed them from all other groups including Domain Users. I have not yet assigned them any permissions to the server they should have access to.

But apparently that's not enough to prevent them from logging into all of my servers. They are unable to access anything via RDP, but CAN login locally to my Windows 2008R2 servers.

I've looked through all group policies and "Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow log on locally" is undefined.

In Local Security Policy, the same setting lists "Administrators, Backup Operators, Users". Does users include anyone in active directory, even if they aren't in Domain Users?

I want this particular user to only be allowed to login to one server to setup their software. What do I need to do to prevent them from logging into other systems?

Edit: A little more digging shows Authenticated Users and INTERACTIVE are members of the local Users group...from what I've read, it might be unwise to change that. So what's the right way of creating a user account with access to NOTHING, then giving them specific permissions to a few machines?

share|improve this question
up vote 4 down vote accepted

You want to limit this using the "Log on to" property in the account tab of the user's account in ADUC. Don't bother messing with GPO for a single user that you need to limit.

enter image description here

share|improve this answer
Thank you! I completely forgot about that option. – Grant Nov 2 '12 at 13:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.