1

I have a small group of desktop servers and I do not want anyone to be able to log on to them locally except for administrators.

We have a Windows 2003 AD and the servers are running Windows 7 Pro.

I know that I can:

Create an OU in AD with said computers, and assign a Group Policy to that OU. Then, in the Group Policy Editor, go to: Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow log on locally and delete all groups/users except for Domain Administrators, Remote Users, and Administrators?

Is it better to do this this through Group Policy, or configure this on each machine?

Improve this question
4
  • Please explain your definition of "Log on locally". If the user is a domain user then they won't be able to log on locally to the computer anyway. The exception being if they lose access to the DC, but their credentials are cached. But even so, they'd still be logged on as a domain user.
    – Dan
    Feb 14, 2012 at 16:05
  • 1
    Just to be clear. A server running Windows 7 isn't a Server at all.
    – MDMarra
    Feb 14, 2012 at 16:07
  • correct, a win7 machine is not technically a server but it is used as one by servicing images in a PACS system. It runs 24/7 and no one is suppose to use the computer, except I noticed on the logon screen someone has been using it.
    – Logman
    Feb 14, 2012 at 16:18
  • "Log on locally" is anyone sitting in front of the computer. There are only admin local user accounts, so I need to stop domain users (non-admin) from accessing the computer.
    – Logman
    Feb 14, 2012 at 16:20

1 Answer 1

Reset to default
2

The way that you mentioned is the best way to do this.

You can configure this on each individual computer, but there's no benefit. Doing it via GPO is much more scalable.

Improve this answer
4
  • I noticed after doing the above, the computers host name does not resolve anymore, but the ip does. I can not even ping the computer using the host name... side effect?
    – Logman
    Feb 14, 2012 at 20:43
  • 1
    No. I used a similar method to lock down wireless guest accounts that authenticate against AD with no adverse effects. You must have some kind of non-standard config.
    – MDMarra
    Feb 15, 2012 at 0:21
  • resolving the host name worked the next day.
    – Logman
    Feb 16, 2012 at 12:27
  • @Logman Sounds like you have bad DNS scavenging settings or something completely unrelated to this policy and the two coinciding was a coincidence.
    – MDMarra
    Feb 16, 2012 at 13:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .