[Last Call] Learn about multicloud storage options and how to improve your company's cloud strategy. Register Now

x
?
Solved

Restrict logon with Group Policy

Posted on 2004-03-22
8
Medium Priority
?
2,261 Views
Last Modified: 2012-05-04
I have a Windows 2k domain with XP workstations.  I have one workstation that I want to restrict logon to one user, let's call him joe.  I would like to make this change on the server rather than on the client to make it easier to manage.
I created a new OU and placed the computer in that OU.  I then created a new group policy object for that OU and I defined the 'Log on Locally' to have just joe in the list.
I then when to the client machine and ran gpupdate and restarted.  I tried logging on with a different user(besides joe, and not an aministrator) and it still let me login.
I looked at the Local Security Policy on the client and it had inherited the correct settings from Active Directory - that is, Log On Locally had Administrators(which I guess is just thrown in by default) and Joe in the list.  I could tell that it had inherited because the icon was different and I was not able to update it.
So, even through only Administrators and Joe are in the list, it is still letting others logon.  The only way that I have found to keep other users out is to add them to the Deny Log On Locally but I don't want to use that because then I would have to modify that list every time I create a new user.
Also, I do not want to create a group that contains all users except Joe.
0
Comment
Question by:ErnieExpert
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
  • 2
8 Comments
 
LVL 7

Expert Comment

by:Isigow
ID: 10651995
Add 'Domain Users' to the Deny logon Locally list
That should remove all other users from the ability to logon, except that Joe has an exception already so he should still be able to.

Isi
0
 
LVL 2

Author Comment

by:ErnieExpert
ID: 10652035
no, that will not work because Deny permissions take precedense and since Joe is member of Domain Users, Joe would then be denied permission.
0
 
LVL 11

Expert Comment

by:kabaam
ID: 10654419
you may have a domain policy that is overriding this setting.
also check the permissions on the gpo for the computer OU.  joe needs read and apply


http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/gpotool-o.asp
http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/gpresult-o.asp
0
Nothing ever in the clear!

This technical paper will help you implement VMware’s VM encryption as well as implement Veeam encryption which together will achieve the nothing ever in the clear goal. If a bad guy steals VMs, backups or traffic they get nothing.

 
LVL 2

Author Comment

by:ErnieExpert
ID: 10661353
The domain policy does not have anything defined for 'Log on Locally'  so I don't think that that is conflicting.
I checked the permissions and Authenticated Users have Read and apply permission

I ran gpresult on the workstation and it showed that it was in the new OU that I created for it.  It also reported that it was applying the group policy from the new OU so that confirms that it is applying it.

0
 
LVL 7

Accepted Solution

by:
Isigow earned 300 total points
ID: 10661502
Odd thing is, I just tried this on a 2k server and it worked fine, on an XP workstation it still allowed Domain Users in...
Anyone know of why XP (and possible 2k workstation) does this while server does not? (not a DC, just a standard server)

Isi
0
 
LVL 11

Assisted Solution

by:kabaam
kabaam earned 200 total points
ID: 10669178
you best bet maybe to edit the local policy on the machine. instead of the OU level.
this will ensure there are not any compatibility issues.

http://support.microsoft.com/default.aspx?scid=kb;en-us;823659
0
 
LVL 2

Author Comment

by:ErnieExpert
ID: 11143158
Thanks Isigow for taking the time to test this out.  I ran the same test and came out with the same results.  I tried kabaam's suggestion and that worked.  It did not exactly answer my request bacause I said that I wanted to be able to manage it from the server, however, this seems to be the best solution for now.
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Sometimes you might need to configure routing based not only on destination IP address, but also on a combination of destination IP address (or hostname) and destination port number. I will describe a method how to accomplish this with free tools. …
Are you one of those front-line IT Service Desk staff fielding calls, replying to emails, all-the-while working to resolve end-user technological nightmares? I am! That's why I have put together this brief overview of tools and techniques I use in o…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
In this video, Percona Director of Solution Engineering Jon Tobin discusses the function and features of Percona Server for MongoDB. How Percona can help Percona can help you determine if Percona Server for MongoDB is the right solution for …

656 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question