2

We have 70+ PCs and servers, users access files by accessing the servers from their PCs.

Is it possible to deny access to all PCs and servers on a network for a guest user (he should only have access to his computer) from active directory or group policy.
I've read some articles which suggest denying access from the file share - going to each file share and denying access - since we have many computers and many file shares this will take a long time, is there any quicker way to do this?

We are running server 2008.

If anyone can offer any advice or direct me on the right path I'd greatly appreciate it.

  • Of course all newbies in IT have to start somewhere, and landing a job is a good way to get experience. At the same time, there are many pitfalls that you have before you that can have serious business consequences. The most valuable thing you can do as the IT person for an organization is make sure there is appropriate, experienced, professional support, so you should consider finding a consulting firm that can help you with checking your network for problems and dealing with more complicated, advanced tasks - as a backup to you. This will make you look good in the long run. – Todd Wilcox May 12 '16 at 17:57
3

Assuming you have not granted the Everyone object access to any resources, you can just make a local account on the computer(s) that the guest will use. They log on to the computer(s) with that account, and they have not even logged on to the domain, so by default they have no access to any domain resources.

If you must use a domain account, create a brand new domain account and create a new domain security group (you could call it something like "Guest Users") for that account to be in. Add the account to the group, set the new group as the user's primary group, and then remove the user from the Domain Users group. Now the user should have access to nothing on the domain, assuming again that you have not granted access to anything for the Everyone object, because no one could have granted access to anything in the past for a brand new user or group.

If you have granted access to anything for Everyone, or you have reason to think that Everyone might have any access rights to any resources, then you have to run that down and correct it. One object that you can almost always get away with using as a replacement for Everyone is Domain Users, because in general, every domain account is a member of Domain Users (unless the account has been specifically removed, as described above). Note that you should not change permissions to resources that your users are using during business hours, as they are likely to be denied access by your changes until the next time they log on and get a security token. Ideally, you would have some experienced consultants on-hand to help you with this kind of permissions change, since it's very possible to accidentally either deny users access to important resources or grant users access to confidential information.

If the computer(s) will never be used by full staff to need domain access, you can dedicate the computer(s) to guest access and not even join them to the domain. Finally, the ultimate separation for guests would be for the computer(s) in question to be on a separate network or VLAN from the domain computers, possibly sharing internet through a firewall with multiple physical or virtual interfaces, or even with a separate, dedicated firewall and internet connection.

  • @Levi91 Feel free to upvote my answer if you found it helpful (click on the little up triangle above the zero in the upper left area of an answer to upvote it). If an answer solves your problem, it's customary to upvote it and also "accept" it by clicking on the check mark. – Todd Wilcox May 12 '16 at 21:05
  • some of the shares do have Everyone permission enabled, so I will have to go to each and every share and check it out, is there a program which can audit this for me? – Levi91 May 12 '16 at 21:08
  • @Levi91 Not that I know of. You might be able to find or write a powershell script to handle it. – Todd Wilcox May 12 '16 at 21:09
  • @Levi91 Thanks. I didn't realize upvotes were restricted at first. – Todd Wilcox May 12 '16 at 21:13
2

If the guest user account is an Active Directory account, why don't you go to the user account in Active Directory, go to Properties, go to the Account Tab, Click the Log On To... button, and enter the names of the computers you are going to allow the guest user to logon to?

Todd's points should also be considered before you decide how to implement this. If you have computers that have shares that are configured for Share and NTFS permissions of Everyone Allow Full then you need to deal with that.

The correct way to have guest access on a network that is separate from your production network is to have the guest network on a separate Virtual Local Area Network (VLAN) as Todd pointed out.

A lot of people seem to think that allowing guest access to their network isn't a big deal and they can just flip a switch and have it work but not give those same guests access to their network. That just isn't how this works. Planning saves a lot of headaches so if you think you might have a need to provide guests with Internet access but keep them out of your production network you should take the time to properly design and segregate your network using VLANs. It isn't a small task but when configured correctly properly keeps the two networks segregated while giving both access to the Internet (or other resources like printers or servers).

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.