I have (simplified) two AD Groups for Users:


I have (simplified) two AD Groups for Computers (like in two rooms)


I want students to only be able to login computers in Room1.

I set up a Group Policy, ("denyStudents") to bgs.ac.at\Room2 and set

Computer Configuration > Policies > Security Settings > Local Policies > User Rights Assignment. > Deny log on locally

At this point I am stuck...

How do I include bgs.ac.at\Students at this point??

  • 1
    When you say Groups do you mean OUs? – TheCleaner Apr 8 '14 at 16:24

It sounds like there's some confused terminology here between OU and group. An OU, or Organizational Unit, is basically where you apply group policy. A group is a bunch of users.

If you want to use the approach in your question, you'll need to create a group that contains the students and refer to that in your policy.

If you want to use Zoredache's approach (recommended), you'll need to create a group that contains the teachers and refer to that in a policy in Computer Configuration -> Preferences -> Control Panel Settings -> Local Users and Groups (replace Domain Users with the Teachers group).


It will be much better to not give login permissions to the users in the first place, instead of trying to deny access.

A simple solution would be to just use a Group policy to modify the membership of the Users group on the local machines.

Remove the domain.tld\Domain Users that is added automatically after joining the domain, and then add a security group(s) that contains the set of users you wish to have access to the machine into that group.

So the membership of .\Users on Room1 computers might look like this.

  • bgs.ac.at\Students
  • bgs.ac.at\Teachers

And Room2 might look like this.

  • bgs.ac.at\Teachers

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.