Disabling Students from logging onto Computers in unsupervised areas

[Neville]

I want to stop users from logging onto certain machines that are in places where they are unsupervised, I have disabled the machine accounts in Active Directory but users are still able to logon to the machines.

 

What is the best way to do this or what is going on why disabling the computer accounts hasn't worked.

[FN-GM]

In group policy under local settigns you can restric it so a particular group cant logon?

 

Do you want the students not to be able to logon at all?

[Neville]

Many Thanks we don't want the students logging onto the computers at all.

[SC-UK]

Do you not want them logging into these machines at all ever (i.e. admin machines) or are they student machines that simply need to be "out of bounds" whilst they are unsupervised?

[Neville]

They need to be disabled for ever untill further notice, and switched back on when when need be.

[SC-UK]

In that case as FN-GM suggests, add the students group in GP to the option that prevents them logging into machines in a particular OU.

 

See here - hoping somebody will be able to clarify for me exactly what the setting is called and where abouts it is! http://www.edugeek.net/forums/scripts/31825-teachers-computers.html

 

Tom

[Michael]

I have disabled the machine accounts in Active Directory but users are still able to logon to the machines

 

There's something not right there. That should stop anyone logging onto the machines.

 

Other than this (and Active Directory is a bit weak here), highlight a selection of pupils, right click > Properties. Choose the 'Account' tab and tick to enable Computer Restrictions. Click the 'Log On To' button, select 'The following computers' and only type in the machines you want pupils to logon to. This could be a long job if you have hundreds of machines unfortunately.

[mac_shinobi]

so its not possible to drag and drop those computers into a selected OU and restrict a list of users logging into those computers ?

[MicrodigitUK]

so its not possible to drag and drop those computers into a selected OU and restrict a list of users logging into those computers ?

 

I have it working on my site with an OU that stops any member of the Students group login on. I also do the same to individual workstations in other OUs. To do these apply GPOs by Security group membership of the workstation and then just make the teaching computer a member of that group (allowed to apply the GPO that stop student logon).

[SYNACK]

so its not possible to drag and drop those computers into a selected OU and restrict a list of users logging into those computers ?

 

Its easy to just have a permit list of users or groups instead:

 

There is a way to do this that will allow you to just let the teachers on and block everyone else without needing to specify each group individually.

 

Make sure you have a security group with your teachers in it. Then chuck the machine into its own OU under where it is at the moment in AD and add a new group policy object to that OU. Inside that group policy you want to go to:

 

Computer Configuration> Windows Settings> Security Settings> Local Policies> User Rights Assignment: Log on locally

 

Then remove the Users group and the add the group that you created earlier. This will let your two teacher log on and also allow administrators to in case they/you need to fix something.

 

Have this setup in our school office to stop teachers messing with the reception computers.

 

Adapted from: http://www.edugeek.net/forums/windows/18819-restricting-who-can-log-certain-machine.html#post186799

[MicrodigitUK]

I made a new GPO called “No Students Logon” under the “MainSite” container(OU).

 

In the “No Students Logon” GPO properties tick the box for “disable the User Configuration settings” for minor efficiency.

 

Made a new security group “No Students Logon” in “Sheldon.internal” and ensured that the only group that can apply the “No Students Logon” GPO is “ProjectorsGroup”.

 

Edited the “No Students Logon” policy go to "Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Deny Logon Local", enable that setting and only add the existing "Students" group.

 

And for each computer that students are NOT allowed to log onto, in active directory I went to the computers “properties” and to the “member of” tab adding “ProjectorsGroup” and that should ban all students from that computer.