Only allow teacher logins on a client

[zag]

I'm thinking about putting a few computers in classrooms that are also used for the kids on their lunch. Historically the kids have messed around on these computers so we haven't put to many out.

 

Now I was thinking what if I could only let teachers login to them that would solve the problem.

 

Any ideas how to do this?

[localzuk]

You can do this via GPO.

 

There is a setting under Computer Configuration -> Windows Settings -> Security Settings -> User Rights Assignment -> Log on locally.

 

Apply that to a group or OU, and you'll be able to restrict login.

[Steve21]

Are you saying they'll have a secondary logon for those computers? Or you want only teacher accounts to be able to logon, and you'll just let kids have full access to their accounts? (Doesn't seem best idea )

 

You can block certain OUs from accessing certain computers certainly yes.

 

* Edit - Seems I was slow again, too early!

 

Steve

[DAZZD88]

@localzuk's method works absolutely fine. Once the allowed groups are added, things are normal until a restricted user tries to log on, at which point they're are given a message about not being allowed to logon interactively. We just implemented this on one machine and it work flawlesly.

[zag]

No I simply want to allow a teachers group only to log onto a computer.

 

I think the above group policy should do it thanks.