Solved

Non-interactive AD account

Posted on 2011-09-23
3
1,319 Views
Last Modified: 2013-12-09
Hi Experts,

Is there a way I can create a non-interactive or 'lowest permission level' account/group for cerain users who require RADIUS access?

Basically, I have a group of users who have an AD account for the purposes of authenticating via wireless via RADIUS using their non-domain member devices (laptops, Andriod devices etc..) and I need their logins to only work for the sole purpose of authenticating via wireless via RADIUS with no interactive logon access to any domain workstation etc...

I currently have these users in the Domain Guests, Guests group and a security group defining wireless access for the NPS policy, however of course they will still be able to login interactively.

I did create another security group for the sole purpose of 'flagging' the user for non-interactive logon by adding that security group to the 'Deny Logon Locally' group policy and having my non-interactive users in that group as well, however this also cut off authentication via wireless via RADIUS :(
0
Comment
Question by:BradyAU
  • 2
3 Comments
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 36587070
I would check for that AD LDS instance. It can be used for authentication but cannot be use for user logon. I don't know if it works for that scenario (I've never done this before) But maybe you are interested in this subject and can dig something in the Internet?

For reference please start with this MS article at
http://technet.microsoft.com/pl-pl/library/cc755080%28WS.10%29.aspx

Regards,
Krzysztof
0
 

Accepted Solution

by:
BradyAU earned 0 total points
ID: 36813735
I was more leaning to just putting the user into a group that had limited access rather than using LDS. E.g. now they are in the Guest group + the WIFI security group.
0
 

Author Closing Comment

by:BradyAU
ID: 38144580
Idea worked
0

Featured Post

[Webinar] Disaster Recovery and Cloud Management

Learn from Unigma and CloudBerry industry veterans which providers are best for certain use cases and how to lower cloud costs, how to grow your Managed Services practice in IaaS clouds, and how to utilize public cloud for Disaster Recovery

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Phishing is at the top of most security top 10 efforts you should be pursuing in 2016 and beyond. If you don't have phishing incorporated into your Security Awareness Program yet, now is the time. Phishers, and the scams they use, are only going to …
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

24 Experts available now in Live!

Get 1:1 Help Now