[Webinar] Streamline your web hosting managementRegister Today

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 192
  • Last Modified:

Restrictions on OU level in Windows 2003

hi,

I have windows2003 domain i just installed. I just wana know that , is it possible that if OU A, OU B and OU C are created , in OU A & B there are Users and in OU C there are computers. I want to put restrictions on the users of OU A so that even if any user of OU A physically wants to login from the computers of OU C then he/she should have access denied while the users of OU B should be able to login.

So is it possible in OU level to restrict users of one OU to not be able to even physically login to the computers of another OU?
0
amirkasalam
Asked:
amirkasalam
1 Solution
 
mdiglioCommented:
Hello,

I don't think AD is dynamic enough to do this based upon an OU.

What you can do is create a new security group called 'UsersB'
highlight all users in ou B and add them to the 'UsersB' group.

Now in the Group Policy for OU C expand
coputer configuration >> windows settings >> security sttings >>
local policies>>user rights assignment >> 
double click the 'logon locally' policy and add the newly created group,
and all other groups\users you will need to administer these computers

When you click browse to add this group you will have to change the 'object types'
to look for Groups as well

This will allow only the users specified to logon to the computers in the OU

Hope this works for you!
0

Featured Post

Learn to develop an Android App

Want to increase your earning potential in 2018? Pad your resume with app building experience. Learn how with this hands-on course.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now