This question is to do with a DC on a computer and not Azure AD.

Users, when created, in an Active Directory domain can, by default, log into all computers that have joined the same domain.
Active Directory Default Domain User permissions?

  1. Do I need to apply an GPO [group policy] to prevent this behaviour?
  2. Would the process be like this:
    a. create an OU [as by default the computers are in a container and not an OU; GPOs only apply to an OU]
    b. move all computers to that OU
  3. What does the GPO look like? A screenshot would be great!

Thanks for any help. I'm sorry if this has all been documented somewhere else but I cannot find this info elsewhere simply stated.


There are two GPO policies that control this:

  1. Allow Logon Locally
  2. Deny Logon Locally

Test this thoroughly, as these two policies often have unintended consequences. In other words, don’t wipeout the default user groups in the allow list inadvertently or no one will be able to logon. Additionally, don’t add users to the deny list or no one will be able to logon. Remember, “users” aren’t the only accounts that logon to your computers.

Rebuild the default allow list without the users group and add whatever groups/users you want to allow to logon.

They are computer policies, and are applied to an OU that contains the computers affected.

  • As an additional note, for this kind of thing, I highly recommend using AD groups to control the users defined by the policy rather than adding lists of individual users. To define the controlled computers, an AD group might also be more desirable than creating a special OU (that's more horses for courses). – Trix Feb 26 at 3:37
  • Watch out, as these policies deny all possible logons, including network logons; so if the policy it's applied to, let's say, a file server, when a user tries to access a share, the server won't allow it. – curropar Feb 27 at 16:57
  • @curropar actually these policies only affect local (interactive) logins. There are different policies for network logins. – Appleoddity Feb 27 at 17:17

The easiest way is to use the Log On To account policy in the user’s account in Active Directory (AD).

  • Open the user’s account properties in the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in.
  • Select the Account tab and click Log On To. Then, click Logon Workstations, select The following computers, enter the name of the workstation you want to restrict the user to, and click Add.
  • I think the question is more about stopping most users from being able to logon to certain computers rather than constraining a single user from logging onto most computers. Even in the latter scenario, if it's more than a few computers the user should be able to logon to, a GPO might still be better. – Trix Feb 26 at 3:35

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.