How to restrict service account login to just the computers contained in 1 OU without specifying all the computers it can login to (in the properties of the service account)?

I would like a new service account we have to ONLY be able to login to computers contained in a specific OU.  This OU has many computer accounts contained in sub OU's so I do not want to list each computer in the service accounts' properties (under the "Log On To..." button).  
Is this possible via GPO? or some other solution?
TaraCAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

sk_raja_rajaCommented:
yeah create a OU, link it to the OU with the setting "Log on locally"  for service accounts only
0
TaraCAuthor Commented:
Sorry... I know to do that, but how do I stop that service account from logging in anywhere else in the domain?  this one service accounts' login permission should be restricted to just this OU structure.
Thank you,
0
sk_raja_rajaCommented:
1.you can better do it by defining the " Deny logon locally" on a group policy and link it in the domain level.
2. Block the inheritance on the OU which you want to allow this service account to login.
3.Create a GP on this OU, define "allow logon locally" and enforce it
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

TaraCAuthor Commented:
Thank you, I was thinking the same but was hoping for a better solution besides Blocking Inheritance.  There are lots of things we apply at the domain level and I'd rather just keep inheritance applied.
0
TaraCAuthor Commented:
Any other solutions to this problem?  
Thanks,
0
sk_raja_rajaCommented:
Ok...

1.Create the policy you want to apply and define the settings "deny log on locally" for service account.
2. Go to the properties for the policy (right click on the policy name and select properties) and select the Security tab.
3.Remove the Apply Group Policy right for Authenticated Users.
4 Next click Add and select the service account
5.Give it Read and Apply Group Policy permissions.
6. Now link it on the domain level and do not enfore
7.Create a new policy with "allow log on locally" on your desire OU and no need to block inheritance here
8.Now enforce this policy

****************Please test this in your test lab before applying it in production server**************
Also ref this posts

http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/2003_Server/Q_22071448.html
http://www.experts-exchange.com/OS/Miscellaneous/Q_20830383.html
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
TaraCAuthor Commented:
This is a good solution ... BUT  (always a but).... doing it this way, I would now need to define all possible users that would login to the computers in that desired OU.  I'm checking now to see if an existing list of users is defined anyway
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.