Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have Samba setup and running nicely as a primary domain controller with roaming profiles. Currently users can log on to the domain controller from any machine in the network.

However, I want to know if its possible to prevent users from logging on from specific machines on the network (for example, there may be certain machines that only a subset of domain users should have access to). I've searched high and low but can't seem to find anything that meets this requirement.

I initially thought I could do something like this in my smb.conf:

  root preexec = /srv/scripts/ %U %m
  root preexec close = yes

..and then get the script to return 1 if the user is not permitted to logon from that particular machine. However, all this does is to prevent access to the NETLOGON share (which stops the logon script from being executed) but doesn't actually prevent the domain logon.

Is this even possible?

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.