<div>
You're both correct, although what I really wanted to know was exactly how to do it.<br />
<br />
I found this article:<br />
<br />
<a href="http://www.microsoft.com/technet/security/prodtech/windows2000/w2kccadm/localpol/w2kadm12.mspx" rel="ugc nofollow">http://www.microsoft.com/technet/security/prodtech/windows2000/w2kccadm/localpol/w2kadm12.mspx</a><br />
<br />
and worked out that the policy I wanted was Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Logon Locally.<br />
<br />
By specifying one group for this it seems to work fine.
</div>


You're both correct, although what I really wanted to know was exactly how to do it.

I found this article:

http://www.microsoft.com/technet/security/prodtech/windows2000/w2kccadm/localpol/w2kadm12.mspx [http://www.microsoft.com/technet/security/prodtech/windows2000/w2kccadm/localpol/w2kadm12.mspx]

and worked out that the policy I wanted was Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Logon Locally.

By specifying one group for this it seems to work fine.

<div>
<div class="content wysiwyg-content">
Hi,<br />
<br />
I'm familiar with the user account option to restrict use of the account to a list of named computers.<br />
<br />
What I want to do is the opposite. For certain computers I only want certain accounts to have access.<br />
<br />
E.g. User U1 can login to all computers, but user U2 can log into most computers not five of them.<br />
<br />
I could do this by setting allowed workstations for every account but, apart from being a lot work, this seems a clumsy solution.<br />
<br />
Is there a better way?<br />
<br />
W2003 domain, XP Pro clients.<br />
<br />
Thanks,<br />
<br />
Leon...
</div>
</div>


Hi,

I'm familiar with the user account option to restrict use of the account to a list of named computers.

What I want to do is the opposite. For certain computers I only want certain accounts to have access.

E.g. User U1 can login to all computers, but user U2 can log into most computers not five of them.

I could do this by setting allowed workstations for every account but, apart from being a lot work, this seems a clumsy solution.

Is there a better way?

W2003 domain, XP Pro clients.

Thanks,

Leon...

Restrict computers to specific user accounts in AD

Windows Server 2003 was based on Windows XP and was released in four editions: Web, Standard, Enterprise and Datacenter. It also had derivative versions for clusters, storage and Microsoft’s Small Business Server. Important upgrades included integrating Internet Information Services (IIS), improvements to Active Directory (AD) and Group Policy (GP), and the migration to Automated System Recovery (ASR).