Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

Restrict a domain User to 1 machine

Posted on 2014-04-24
5
467 Views
Last Modified: 2014-05-17
We have a vendor active directory account that we enable and disable for the vendor to log into 1 computer in our system. Is there a way to deny access to everything accept this computer for the vendor user?
0
Comment
Question by:portillosjohn
5 Comments
 
LVL 57

Expert Comment

by:Mike Kline
ID: 40020527
In the account tab of that user you will see "Log On To" use that to allow the one PC you want him to use.

Thanks

Mike
0
 
LVL 7

Expert Comment

by:Mohammed Tahir
ID: 40020552
0
 

Author Comment

by:portillosjohn
ID: 40020828
Is there a way to prevent the logged in user from viewing the "network" computers? or restrict the user from even viewing shares?
0
 
LVL 95

Assisted Solution

by:Lee W, MVP
Lee W, MVP earned 250 total points
ID: 40021085
Don't put him in groups that have access to the shares and disable network discovery on that computer - unless others on that computer need access to network discovery.

Find out (this may be trial and error on your part) what rights/permissions the account needs and give it ONLY THE MINIMUM.  If they need admin rights, give them LOCAL admin rights on the system.  Remove them from Domain Users and other groups.

Potentially, ONLY give them a local user account on the machine, NOT A domain account.

http://windows.microsoft.com/en-us/windows/what-is-network-discovery#1TC=windows-7
0
 
LVL 54

Accepted Solution

by:
McKnife earned 250 total points
ID: 40021434
There's also this policy: http://technet.microsoft.com/en-us/library/cc758316(v=ws.10).aspx
This security setting determines which users are prevented from accessing a computer over the network
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This script can help you clean up your user profile database by comparing profiles to Active Directory users in a particular OU, and removing the profiles that don't match.
This article runs through the process of deploying a single EXE application selectively to a group of user.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question