Staff Only Computer

[karldenton]

Hi,

Thought this might have been answered before but can't seem to find it on here. Is there a way in GP to make a machine so only staff can log onto it ? It can go in its own OU if needed.

Thanks

[MYK-IT]

You can deny the security groups / users that you don't want to be able to log on (i.e. Students)

 

Within the GPO that applies to the computer(s) in questions apply the following:

 

Computer Configuration

Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment

 

Deny log on locally {enter security groups / user accounts to deny here}

[round2it]

+1 for this

[srochford]

You can also do this the other way round - remove "domain users" from the local users group and add in "staff" (or whatever group you need) (so you're allowing a specific group rather than denying all the others)

 

Note that if you do this on Windows 7, people who aren't in the users group won't be able to log in interactively (you just get a blank desktop)

[round2it]

we have year groups set in that policy to deny if they are in eg ni2010,ni2009,ni2008 etc just remember to add the next year group at the beginning of the new term