Permitting only one user to log on to a workstation

[ctbjs]

This is not related to simultaneous log on.

I have one user that has a workstation that has data on it that we do not want any other user to have access to. It resides on the C Drive of this machine (and is backed up to the network) and therefore cannot be protected on the network. We want to be able to restrict the use of this machine to this one user only (plus domain admins of course). Anyone done this before and if so how?

[plexer]

Why can't the data live in the users home folder so that only they have access to it?

Or just set the ntfs permissions on it so only that user and admin can access the particular folder?

Ben

[FN-GM]

If you put the computer in its own OU or create another group policy in its current OU and set the security so that computer can only upload the policy. Then in group policy define the users/groups that are allowed to logon or that aren’t allowed what ever is easiest. In the group policy its under Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Logon Locally / Denny Logon Locally

[plock]

I would suggest changing the NTFS permissions accordingly, NTFS will restrict the files/folders to individuals or security groups defined on the 'Security' tab.

[Geoff]

Also ensure this data is being backed up (and thus, the backups are secure from inquisitive users).

[altecsole]

You could add a script to the all user startup folder that checks the username and logs off anyone not on the list, eg:

@echo off
if %username%==YourUser exit
if %username%==Admin exit
shutdown -l

[ctbjs]

@Plex

Because if it could have gone there as a network admin that is the first place I would have put it!!

@FN

This is virtually what I did in the end although instead of using the logon locally option used the "Access this computer from the network". This works well.

@plock

Another nice idea that we tried but the fact that a user can access the machine in the first instance was the point we were looking for here.

@Geoff

Part of the original question indicates that the files/folders are backed up to the network.

@altecsole

Good idea, I haven't tried this one yet but will give it a go

Thanks for your answers, issue resolved

[mark80]

So do share the solution

[_Bat_]

@FN

This is virtually what I did in the end although instead of using the logon locally option used the "Access this computer from the network". This works well.