Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server with Windows Server 2008 which is joined to our local Active Directory Domain. This means that anyone can access it by default, but only certain specific users are Administrators. Instead, I would rather have it only allow a certain whitelist of users access to the computer. Does anyone know how to do this?

share|improve this question
When you say "anyone can access it", what are you referring to? Logging on to it? – joeqwerty Sep 14 '09 at 15:05
Yes. Anyone with a domain login is able to login to the computer. This is what I want to restrict. – Mike Sep 14 '09 at 15:16
up vote 2 down vote accepted
  1. You would need to remove the 'domain users' from the local 'users' group. - that is where they are getting thier permissions to log into the machine.
  2. Then create a new group in AD that has the people you want to access the machine.
  3. Add that new group to the local 'users' group of the machine you want to limit.

Then you just need to add a user to the new group to give them permissions to log into the box.

share|improve this answer
Awesome! This appears to be working properly. Thanks very much. – Mike Sep 14 '09 at 15:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.