Hi there I am having a bit of a simple task problems. We have pretty simple configured MS server 2012 in our school. The thing is we want to deny access few PCs from ONE user so our students can only access library PC with their OWN account as we want to monitor their actions.

I have one user (library_user) and this user should NOT be able to log on to three specific PCs on domain.

I tried to use ntrights for this but no luck, I get OpenPolicy error but I can confirm I am running with admin privilegies. Is there any fix for this and is NThrights the right option for me as I need to block access to domain PCs?

Thank you very much and sorry for such a silly question. I am new here :)

  • I tried to use "Deny Local Login" on Local Policy but no luck, I cannot add a user to exception, its all grayed out somehow – Edmunds Mar 10 at 7:49
  • You have the right setting. Is the server joined to a domain? Local policy editor won't let you configure that setting if it is already configured by a domain policy. You can run rsop.msc to confirm. – twconnell Mar 10 at 8:35
  • Yes our server is joined to domain. Any other solution for this? And what does rsop.msc do? I just did run it, seems like there are no policy errors – Edmunds Mar 10 at 9:21

You can use the Resultant Set of Policy utility (Rsop.msc) to identify which domain GPO is applying the 'Deny log on locally' user rights assignment policy setting. To override this, you would need to create a new GPO filtered only to your target server(s) to apply a new value for this setting. I would recommend using GPO security filtering to the computer objects needing the policy and linking the policy to the OU containing those computers. You do this by removing the 'Apply group policy' permission from Authenticated Users on the Group Policy security settings and give that permission explicitly to your server. You need to ensure the new GPO has a higher precedence than any other GPO configuring that setting. Also note that this setting is not merged, the last policy to apply it wins. You may want to include the values from the previous policy and append your specific changes. For example, it is pretty standard to deny your Domain Admins this user right on all non-Domain Controllers to prevent those credentials from being exposed. You would want to maintain that deny by including it in your new policy.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.