Restrict computers to specific user accounts in AD

Posted on 2006-05-27
Last Modified: 2010-04-18

I'm familiar with the user account option to restrict use of the account to a list of named computers.

What I want to do is the opposite. For certain computers I only want certain accounts to have access.

E.g. User U1 can login to all computers, but user U2 can log into most computers not five of them.

I could do this by setting allowed workstations for every account but, apart from being a lot work, this seems a clumsy solution.

Is there a better way?

W2003 domain, XP Pro clients.


Question by:leonst
    LVL 9

    Accepted Solution

    Hi leonst,

    You may try grouping computers, may call it public (all workstation) and private(5 computers) when restricting /allowing users allow to log on to public group

    LVL 74

    Assisted Solution

    by:Jeffrey Kane - TechSoEasy
    Almost all Group Policies have both positive and negative settings.  If you want the opposite, then just DENY permission to the list of users instead of GRANTING permission.

    LVL 1

    Author Comment

    You're both correct, although what I really wanted to know was exactly how to do it.

    I found this article:

    and worked out that the policy I wanted was Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Logon Locally.

    By specifying one group for this it seems to work fine.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    IT, Stop Being Called Into Every Meeting

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    by Batuhan Cetin In this article I will be guiding through the process of removing a failed DC metadata from Active Directory (hereafter, AD) using the ntdsutil tool in a Windows Server 2003 environment. These steps are not necessary in a Win…
    On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
    Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
    In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now