Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My university is switching from a Novell based logon system to Active Directory. One of the 'features' IT is advertising is the ability for any user to log onto any machine. This is fine for computer labs and the like, but for computers in offices and graduate student labs we'd really rather not let any random undergrad walk in and log on. Is there an easy way to limit who can log onto a particular machine using active directory? Most computers are running XP, with a few on Vista.

share|improve this question

With the way access control works in Windows, you generally want to think about this type of thing from the opposite direction. Instead of by allowing everyone and then trying to lockout a subset of users, you want to instead allow no one by default and let in the subset of users who should be able to use those systems.

Explicit "Deny" ACLs always take precedence over "Allow" ACLs

It's also a best practice to always target the various security settings at groups and not at specific users. Even if there's only one user that needs access today, it may not always be that way or the user who needs access could also change.

share|improve this answer
  • Create a Group Policy in the domain.
  • Go to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment
  • Edit "Allow log on locally" to contain the groups/users you want to be able to log on.
  • Close the GP, and apply it to an OU containing the computers you want to secure.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.