restricting who can log on to a certain machine

[RabbieBurns]

Got a machine in a room thats unstaffed most of the time.

 

Is there any way to restrict which users are able to log on to that particular machine?

[dan400007]

If its 2000/XP/Vista you could set the 'Deny Logon Locally' to those who you need to deny.

[elsiegee40]

Unfortunately, it's been designed so that you have explicitly prevent individuals from logging on (i.e. you'd have to nominate nearly every user) rather that having a global deny and then enabling one or two people...

 

it's a pain!

[RabbieBurns]

Thanks for the replies.

 

Im trying to deny everyone except 2 teachers heh

 

Can it be done by groups? i.e could I just deny the "students" group?

[DMcCoy]

Thanks for the replies.

 

Im trying to deny everyone except 2 teachers heh

 

Can it be done by groups? i.e could I just deny the "students" group?

 

yes, you can just deny the students group in the "deny logon locally" option in group policy.

[SYNACK]

There is a way to do this that will allow you to just let those two teachers on and block everyone else without massive effort.

 

First create a security group with your two teachers in it. Then chuck the machine into its own OU under where it is at the moment in AD and add a new group policy object to that OU. Inside that group policy you want to go to:

 

Computer Configuration> Windows Settings> Security Settings> Local Policies> User Rights Assignment: Log on locally

 

Then remove the Users group and the add the group that you created earlier. This will let your two teacher log on and also allow administrators to in case they/you need to fix something.

 

Have this setup in our school office to stop teachers messing with the reception computers.

[altecsole]

You could put a batch file in the all user startup script that checks the logged on users username and logs them off if they're not in the list:

 

@echo off
if %username%==john exit
if %username%==jim exit
if %username%==peter exit
if %username%==ken exit
shutdown -l

[SYNACK]

You could put a batch file in the all user startup script that checks the logged on users username and logs them off if they're not in the list:

 

@echo off
if %username%==john exit
if %username%==jim exit
if %username%==peter exit
if %username%==ken exit
shutdown -l

 

Thats a good idea too, I would put it in the logon script though as you can disable the startup items by holding down the shift key while you log in.

 

Troubleshooting the Startup Process

Disabling Startup Programs by Using the SHIFT Key

One way to simplify your configuration is to disable startup programs. Hold down the SHIFT key during the logon process to prevent the operating system from running startup programs or shortcuts in the following folders:

 

systemdrive\Documents and Settings\Username\Start Menu\Programs\Startup

 

systemdrive\Documents and Settings\All Users\Start Menu\Programs\Startup

 

[RabbieBurns]

There is a way to do this that will allow you to just let those two teachers on and block everyone else without massive effort.

 

First create a security group with your two teachers in it. Then chuck the machine into its own OU under where it is at the moment in AD and add a new group policy object to that OU. Inside that group policy you want to go to:

 

Computer Configuration> Windows Settings> Security Settings> Local Policies> User Rights Assignment: Log on locally

 

Then remove the Users group and the add the group that you created earlier. This will let your two teacher log on and also allow administrators to in case they/you need to fix something.

 

Have this setup in our school office to stop teachers messing with the reception computers.

 

spot on. just what i was after. cheers!