I'm fairly new to group policy management. I'm running Windows Server 2008 R2 with Active Directory setup. I have setup my users, assigned them to the proper groups, which consists of regular users, admins/super admins, and some Local Workstation Admins.

I'm trying to prevent users from physically walking up to the server and logging in with their credentials, just like if it were one of our workstations. I want them to be able to login to any of the workstations in the building with their credentials, but not the server. It seems if I change the GPO to deny logon locally, it also denies them the ability to logon to their workstation, as well as the server.

Is it possible to allow only Super Administrators to logon to the physical server, while still allowing Users to logon to their workstations?

  • 1
    You put the servers in a different OU than the workstations and apply separate GPO. – squillman May 2 '14 at 21:08
  • Is this server your (only) domain controller as well? – HopelessN00b May 2 '14 at 21:11
  • Change the local server policy to deny login locally to Domain Users. – uSlackr May 2 '14 at 21:28
  • uSlackr, I believe that's default as part of the Default Domain Controllers policy. – Davidw May 3 '14 at 1:29

Ensure that the server is in a different OU than the workstations, and apply different GPOs to the server OU versus the workstation OU.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.