I have Samba setup and running nicely as a primary domain controller with roaming profiles. Currently users can log on to the domain controller from any machine in the network.
However, I want to know if its possible to prevent users from logging on from specific machines on the network (for example, there may be certain machines that only a subset of domain users should have access to). I've searched high and low but can't seem to find anything that meets this requirement.
I initially thought I could do something like this in my
[netlogon] root preexec = /srv/scripts/check-logon.sh %U %m root preexec close = yes
..and then get the
check-logon.sh script to return 1 if the user is not permitted to logon from that particular machine. However, all this does is to prevent access to the NETLOGON share (which stops the
logon script from being executed) but doesn't actually prevent the domain logon.
Is this even possible?