Only allow certain users to log on to a machine?

[wesleyw]

Does anyone know if a group policy exists whereby you can make sure only certain users can use a specific PC or group of PCs? I know there is a way of doing it in the registry but I can't find anything on group policies. Is there a piece of software that can do this if not?

Wes

[GrumbleDook]

Deny logon locally and set it for a particular security group (eg "allstudent") to stop them logging into machines in a particular OU.

Without access to GPMC I think it is the computer policy, in security policies.

.... but I could be wrong.

[john]

In Active D, you can limit PCs to certain users

[wesleyw]

@John do you know where this is exactly?

[GrumbleDook]

Create a new Security Group, call it "nologongroupstudents".

Create a new GPO, call it "denystudentlogon"

Computer Configuration >
Windows Settings >
Security Settings >
Local Policies >
User Right Assignment and double click on "Deny logon locally"

This then gives you the option of adding individual users or security groups to this policy.

Add the security groups created above.

Apply the GPO to an OU of computers (eg teachers' laptops) and then add the users you *do not* want to log on to those machines into the above security group.

I would recommend you do this by security group rather than individual users as it makes it quicker and easier to change.

[andy]

I'm guessing JohnDs method isn't what you're looking for - this has been discussed earlier (tho I can't find where). It is to be found in a user's account properties and you have to specify which machines a user CAN log on to (a bit of a bummer when there are 150 machines permissable and only 3 not!) Grumbledooks way sounds interesting tho - not considered that

Andy.

[wesleyw]

Yeah, thanks Tony I'll give it a try and see how it goes!

Wes

[john]

@andy, yes, thats the baby. Its useful for stopping fellow admins using my Sitekiosk account on other machines and damaging its profile by accident. But its perfect for allowing say only younger children access to the machines at there part of the site.