I'm trying to setup a limited account for an outside company in active directory. They need to connect to one server to setup their software. I created a new group called "Limited Access", made that their primary group, and removed them from all other groups including Domain Users. I have not yet assigned them any permissions to the server they should have access to.

But apparently that's not enough to prevent them from logging into all of my servers. They are unable to access anything via RDP, but CAN login locally to my Windows 2008R2 servers.

I've looked through all group policies and "Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow log on locally" is undefined.

In Local Security Policy, the same setting lists "Administrators, Backup Operators, Users". Does users include anyone in active directory, even if they aren't in Domain Users?

I want this particular user to only be allowed to login to one server to setup their software. What do I need to do to prevent them from logging into other systems?

Edit: A little more digging shows Authenticated Users and INTERACTIVE are members of the local Users group...from what I've read, it might be unwise to change that. So what's the right way of creating a user account with access to NOTHING, then giving them specific permissions to a few machines?

1 Answer 1


You want to limit this using the "Log on to" property in the account tab of the user's account in ADUC. Don't bother messing with GPO for a single user that you need to limit.

enter image description here


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .