Deny AD-User Group to login on a certain AD-Computer Group

Question

I have (simplified) two AD Groups for Users:

bgs.ac.at\Students
bgs.ac.at\Teachers

I have (simplified) two AD Groups for Computers (like in two rooms)

bgs.ac.at\Room1
bgs.ac.at\Room2

I want students to only be able to login computers in Room1.

I set up a Group Policy, ("denyStudents") to bgs.ac.at\Room2 and set

Computer Configuration > Policies > Security Settings > Local Policies > User Rights Assignment. > Deny log on locally

At this point I am stuck...

How do I include bgs.ac.at\Students at this point??

Answer 1

It sounds like there's some confused terminology here between OU and group. An OU, or Organizational Unit, is basically where you apply group policy. A group is a bunch of users.

If you want to use the approach in your question, you'll need to create a group that contains the students and refer to that in your policy.

If you want to use Zoredache's approach (recommended), you'll need to create a group that contains the teachers and refer to that in a policy in Computer Configuration -> Preferences -> Control Panel Settings -> Local Users and Groups (replace Domain Users with the Teachers group).

Answer 2

It will be much better to not give login permissions to the users in the first place, instead of trying to deny access.

A simple solution would be to just use a Group policy to modify the membership of the Users group on the local machines.

Remove the domain.tld\Domain Users that is added automatically after joining the domain, and then add a security group(s) that contains the set of users you wish to have access to the machine into that group.

So the membership of .\Users on Room1 computers might look like this.

• bgs.ac.at\Students
• bgs.ac.at\Teachers

And Room2 might look like this.

• bgs.ac.at\Teachers