How to prevent domain administrator login on workstations?

[ronanian]

I'd like to prevent the domain administrator account from logging in to PCs. I'd like it to only be able to login to servers. Is that easy to do?

 

(Let's not discuss why...)

[Mcshammer_dj]

use the security settings to set which accounts are allowed to login locally

[jamesb]

Create a GPO denying the domain admin account interactive logon rights and apply it to any OUs which contain client machines. Make sure your servers and DCs are in another OU.

[_techie_]

In AD, you can set the user to only allow logon to X workstations/servers. We have done this with one of our students, since he was being a pain, and we wanted to keep an eye on him. It was also made clear that teaching staff should not allow him to use a computer in any other than the specified room.

 

In AD, select the user account you wish to use, then right click, properties, Account tab, and logon to button. You can then specify which machines/servers the account is able to logon to. We have a server account esp for this.

 

HTH

Mark

[powdarrmonkey]

(Disable the account )

[srochford]

If this is the "administrator" domain account I suspect there's no clean way of blocking it (and even if there is, the administrator can just reverse the changes - they're got god rights in the domain!)

 

If you're running a login script then you could easily put a check to see if the user is domain admin and, if so, log them out.

[ronanian]

Thanks everyone, those are all good ideas. I think I can work with it now.

[jamesb]

If this is the "administrator" domain account I suspect there's no clean way of blocking it (and even if there is, the administrator can just reverse the changes - they're got god rights in the domain!)

 

If you're running a login script then you could easily put a check to see if the user is domain admin and, if so, log them out.

 

Oh trust me, you can block it from logging on. As I discovered once while having a play in AD (VM, not live).

 

Removed interactive logon for all admin users, and had to restore the VM from snapshot.

[srochford]

Oh trust me, you can block it from logging on. As I discovered once while having a play in AD (VM, not live).

 

Removed interactive logon for all admin users, and had to restore the VM from snapshot.

 

Grand :-)

 

I would always leave at least one machine logged on when you're doing things like this as a "just in case"

 

If you were able to log on to a machine in the virtual domain (even as a non-admin) I think you might have been able to do a "runas" to start an elevated command prompt (I think blocking interactive login only blocks pressing CTRL ALT Del to login, not things like web access or process elevation).

 

You could then run up group policy editor and make the changes or use regedit to blank out the policy settings on that machine. Provided you logged off/on quickly you ought to be able to get in as an admin before policy is re-enforced.

 

One last point for the OP - if you absolutely must stop admins logging on to workstations then it's likely to be hard. If you just want to remind them that it's a really bad idea then just popping up a message and logging them off would probably do the trick!