I'm trying to setup a limited account for an outside company in active directory. They need to connect to one server to setup their software. I created a new group called "Limited Access", made that their primary group, and removed them from all other groups including Domain Users. I have not yet assigned them any permissions to the server they should have access to.
But apparently that's not enough to prevent them from logging into all of my servers. They are unable to access anything via RDP, but CAN login locally to my Windows 2008R2 servers.
I've looked through all group policies and "Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow log on locally" is undefined.
In Local Security Policy, the same setting lists "Administrators, Backup Operators, Users". Does users include anyone in active directory, even if they aren't in Domain Users?
I want this particular user to only be allowed to login to one server to setup their software. What do I need to do to prevent them from logging into other systems?
Edit: A little more digging shows Authenticated Users and INTERACTIVE are members of the local Users group...from what I've read, it might be unwise to change that. So what's the right way of creating a user account with access to NOTHING, then giving them specific permissions to a few machines?