In an active directory domain I'd like to have some PCs assigned to single people. For example on computer_a, the only people allowed to logon should be person_a plus the various administrators.

One common solution I found is to use the Logon Locally GPO, but this would require creating a new GPO and OU for each computer, as each computer would be assigned to a different user. Is there a better way?

One possible alternative I'm experimenting with is the following:

  • use GPO to remove from the local users group the following accounts: NT AUTHORITY\INTERACTIVE and NT AUTHORITY\Authenticated Users
  • add the user domain account to the local users group

This seems to work fine, but I'm worried about possible problems caused by the removal of the two special groups.

Is there a better solution?

  • 2
    You're not saving yourself any work with your proposed method. You're still going to have to create a per-computer GPO for every computer. BTW, you don't have to create a separate OU for each computer, you can use Security Filtering on each GPO (linked to a common computer OU) to filter a particular GPO to a particular computer. – joeqwerty Oct 15 '12 at 22:57
  • How many computers are you wanting to do this to? If it's a small amount I would just modify the local security policy. – Bad Dos Oct 15 '12 at 23:46
  • @joeqwerty: I'm adding the domain account to the users group by hand when installing the machine. Not through GPO. – Daniel Oct 15 '12 at 23:48
  • @BadDos: my problem with the local security policy is that then one would have to remember to add all the relevant administrators groups to it as well. It's one extra step I'd like to avoid. – Daniel Oct 15 '12 at 23:52
  • Knowing nothing about the numbers involved I can only wonder if it might not be better or easier to restrict the user accounts to specific machines. – John Gardeniers Oct 16 '12 at 0:18

In the end here's what I did:

  • used the "Allow Log on locally" policy to allow only 'BUILTIN\Administrators', 'DOMAIN\Domain Admins' and 'allowlogon' groups. Where allowlogon is a local group on each machine
  • the allowlogon local group is created on each machine through GPP
  • on each machine just after joining to the domain it is enough to add the specified user to the allowlogon group and he'll be the only one allowed to logon (net localgroup allowlogon /add DOMAIN\user)
    • It's also possible to manage the allowlogon membership through AD without using more GPOs, but simply creating a global security group for each computer (allowlogon-computer1) and putting in there the users allowed to login. The allowlogon-computer1 group will need to be added to the local allowlogon group in computer1, but this can be done through GPP using allowlogon-%COMPUTERNAME% . (it doesn't seem to be possible to simply add the allowlogon-%COMPUTERNAME% to the "Allow log on locally" policy)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.