LImiting who can sign on to a domain user pc

HI -
We are setting up a public pc in our breakroom to allow our "Shop" employees access to the intranet and internet like the office people have (yeah i know I didn't vote for this idea). I have Windows Steady State on the pc and i have locked it down with Group Policy. I also want to lock it so only one username can logon to the pc. How do I do this?

Who is Participating?
tigermattConnect With a Mentor Commented:
I assume you only want a generic user account logging in, such as "Shop user" or something, as opposed to a user's personal user account. In this case I would place the computer account in an OU called "Restricted Computers" or something like that. You can then create a GPO on that OU and use the settings "Deny log on locally" and "Allow logon locally" to set the group of users (or indeed one individual user account) who can log on to the machine. I suspect you will only need to set this in the Allow logon locally group, so try this first and, failing that, look at using Deny logon locally too.
Why not set it up as a stand-alone PC (ie not a domain member) and create a single local user account. Users should still be able to access the internet/intranet and you can use local policies to lock doen the machine.
I dont know if I am right on this, but consider using WMI filtering on Group Policies!
zuleaAuthor Commented:
Great answer. Exactly what I was looking for. Sometimes it is hard to remember where all the GPO settings are when you don't use it everyday.
All Courses

From novice to tech pro — start learning today.