Disable logon for group but allow login for one user in that group

[william_tropico]

Hello,

 

We have a number of Staff laptops. Each have been assigned to an individual member of staff. What we want to do its limit who can log into the laptop. all member of staff belong to the same security group e.g. AllStaff. is it possible to limit this group for loggin into the laptop but allow one user in that group (the user who the laptop is assigned to) to be able to log in.

 

I think that makes sense

 

Thank you,

William

[themightymrp]

In Active Directory, in the properties for each user you can go to the "Account" tab and then the "Log On To" button and manually specify a machine name that the user can log onto? It would mean assigning each staff member to their own machine name...

 

You could combine this with the GPO setting: Computer Config --> Policies --> Windows Settings --> Security Settings --> Local Policies --> User Rights Assignment --> Deny Logon Locally and set it to exclude students

[RichCowell]

In Active Directory, in the properties for each user you can go to the "Account" tab and then the "Log On To" button and manually specify a machine name that the user can log onto? It would mean assigning each staff member to their own machine name...

 

Wouldn't you have to manually add every other machine in school that you want them to be able to log on to then?

[william_tropico]

Wouldn't you have to manually add every other machine in school that you want them to be able to log on to then?

 

I should say that we have teacher desktops in each room so the method mentioned about would not be feasible. Would take too much effort to set up every computer with access.

 

Thank you,

William

[themightymrp]

Yep, I agree its not the best idea. But if staff have their own laptop, would they need to log onto anything else?

[william_tropico]

... But if staff have their own laptop, would they need to log onto anything else?

 

We have had a number of issues of staff sharing laptops and if something is damaged its the assigned who will take responsibility but a lot dispute due to sharing.

 

Thank you,

[sted]

you cant use the staff group as a deny will always beat an allow so unless you add them all manually to each laptop i cant see a way to do it (you might make it a bit easier by adding staff to smaller groups say y1/y2/english etc you could then bulk block most staff and just individually block those in the same dept but it sounds like a lot of work.

 

as to other pcs no just put all laptops in an ou and only apply the policy to those pcs (or add pcs to a group and filter it)

 

Might be easier to sidestep it if they support bitlocker force an individual pin code on everyone then while ever the laptop isnt on they shouldnt know the code to even fire it up

[RichCowell]

Sounds like it's going to be a nightmare to manage with any option this way... You're bound to get loads of requests to let other staff log on to their laptops - when others forget their laptops...

 

If they're staff laptops - surely they're responsible enough to look after their own laptops and not let other people log onto them...

[themightymrp]

 

If they're staff laptops - surely they're responsible enough to look after their own laptops and not let other people log onto them...

 

HAHAHAHAH!!!!

[RichCowell]

HAHAHAHAH!!!!

 

haha maybe not then... They wouldn't dare here

[themightymrp]

You're best bet is to use the GPO option I mentioned above on the OU containing staff laptops. Just deny students the option to log onto the staff laptops. Trying to narrow it down to individuals is going to get too fussy. You could write a complex logon script which checks username against computer name but again it would take too long

[RichCowell]

You're best bet is to use the GPO option I mentioned above on the OU containing staff laptops. Just deny students the option to log onto the staff laptops. Trying to narrow it down to individuals is going to get too fussy. You could write a complex logon script which checks username against computer name but again it would take too long

 

Agreed about it being too fussy...

 

I added something to the login script at my last school that stopped students logging on to staff machines by checking to see if the username began with a 00/01/02 etc. then logged them off automatically... worked really well, but not had chance to faff about and do the same thing here (after nearly 7 years! lol) Once you'd got it right though, that would be far easier to manage than the GPO I would imagine... either way you'd need one GPO or script per member of staff...

[sted]

Agreed about it being too fussy...

 

I added something to the login script at my last school that stopped students logging on to staff machines by checking to see if the username began with a 00/01/02 etc. then logged them off automatically... worked really well, but not had chance to faff about and do the same thing here (after nearly 7 years! lol) Once you'd got it right though, that would be far easier to manage than the GPO I would imagine... either way you'd need one GPO or script per member of staff...

 

scripting with powershell i supose you could get it to query ad for all staff individually add them all to the block list then have a text file called laptop06 or whatever with the allowed user in and get it to then remove the deny for that user but again it sounds like a lot of work

[william_tropico]

If they're staff laptops - surely they're responsible enough to look after their own laptops and not let other people log onto them...

 

HAHA I wish!

 

Maybe the best we can do it limit logon to teachers only (stop the students anyway).

 

I will see what powershell can do for us.

 

Thanks for all the replies though.

 

William

[themightymrp]

I think @sted is on the right lines with breaking things into smaller groups. Split you staff laptops OU into departments, and split your member of staff into departments. Then you could just allow Maths teachers to log onto Maths laptops. The admin side of doing this is not massive and at least you can narrow down the culprits a little better.

 

You could still deny student logons overall to the staff laptops using the GPO mentioned at the beginning

[sted]

I think @sted is on the right lines with breaking things into smaller groups. Split you staff laptops OU into departments, and split your member of staff into departments. Then you could just allow Maths teachers to log onto Maths laptops. The admin side of doing this is not massive and at least you can narrow down the culprits a little better.

 

You could still deny student logons overall to the staff laptops using the GPO mentioned at the beginning

 

i still think if it really must be one to one bitlocker and pin/usb stick is easiest as long as people turn them off and dont share pins/usb drives and even if they do leave them on person 2 can only use it until its turned off

[Michael]

I should say that we have teacher desktops in each room so the method mentioned about would not be feasible. Would take too much effort to set up every computer with access.

 

Thank you,

William

 

Unless you can do something fancy using Powershell and a CSV, but otherwise maybe something third party is required?

 

I agree it's one major flaw in Active Directory and Microsoft need to add more options in this area.

[SYNACK]

If it is locked to the user you need a machine GPO for each staff user then apply that either with individual ou per laptop or wmi filtering on the host name per policy applied to the laptops.

 

 

 

The administrators group will always be allowed through.

 

We had to do this for our office machines as the teachers kept logging in and breaking them.

Edited June 9, 2014 by SYNACK