?
Solved

Restrict a domain User to 1 machine

Posted on 2014-04-24
5
Medium Priority
?
509 Views
Last Modified: 2014-05-17
We have a vendor active directory account that we enable and disable for the vendor to log into 1 computer in our system. Is there a way to deny access to everything accept this computer for the vendor user?
0
Comment
Question by:portillosjohn
5 Comments
 
LVL 57

Expert Comment

by:Mike Kline
ID: 40020527
In the account tab of that user you will see "Log On To" use that to allow the one PC you want him to use.

Thanks

Mike
0
 
LVL 7

Expert Comment

by:Mohammed Tahir
ID: 40020552
0
 

Author Comment

by:portillosjohn
ID: 40020828
Is there a way to prevent the logged in user from viewing the "network" computers? or restrict the user from even viewing shares?
0
 
LVL 97

Assisted Solution

by:Lee W, MVP
Lee W, MVP earned 1000 total points
ID: 40021085
Don't put him in groups that have access to the shares and disable network discovery on that computer - unless others on that computer need access to network discovery.

Find out (this may be trial and error on your part) what rights/permissions the account needs and give it ONLY THE MINIMUM.  If they need admin rights, give them LOCAL admin rights on the system.  Remove them from Domain Users and other groups.

Potentially, ONLY give them a local user account on the machine, NOT A domain account.

http://windows.microsoft.com/en-us/windows/what-is-network-discovery#1TC=windows-7
0
 
LVL 57

Accepted Solution

by:
McKnife earned 1000 total points
ID: 40021434
There's also this policy: http://technet.microsoft.com/en-us/library/cc758316(v=ws.10).aspx
This security setting determines which users are prevented from accessing a computer over the network
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Here's a look at newsworthy articles and community happenings during the last month.
A bad practice commonly found during an account life cycle is to set its password to an initial, insecure password. The Password Reset Tool was developed to make the password reset process easier and more secure.
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

829 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question