Network logon (disable access to logon to "this computer")

Hi.

I've got a network set up with a windows 2000 server and windows XP
clients.

I've currently got the set-up running perfectly fine at the mo, with
users being able to login to the xp machines with no problem.

However, some of the staff know the passwords to log on to their
computer with the local "administrator" account, and so are bypassing
the logon to the network to get full control of the computer (which is
undesirable).

Rather than changing all administrator passwords on all of the local
machines, I would like to remove the option of logging on to the local
machine (if this is possible).

So if someone could let me know whether that is possible, I'd greatly
appreciate it.

Thank you in advance

David Lovell

This would be highly unadvisable, as the administrator being the only user
which can logon in recovery console or in case that the domain would become
unavailable. You could change the local security policy - local policy -
user rights assignment - deny log on locally and add the administrator
there. This policy would only apply if at the domain level is not changed as
the domain is preffered over the local policy.
I repeat - is much better for emergency cases to let the administrator log
on locally and change all passwords...

All the best!


"David Lovell" <david.lovell@northfieldhouse.leicester.sch.uk> wrote in
message news:27168c91.0410280152.51429a86@posting.google.com...
> Hi.
>
> I've got a network set up with a windows 2000 server and windows XP
> clients.
>
> I've currently got the set-up running perfectly fine at the mo, with
> users being able to login to the xp machines with no problem.
>
> However, some of the staff know the passwords to log on to their
> computer with the local "administrator" account, and so are bypassing
> the logon to the network to get full control of the computer (which is
> undesirable).
>
> Rather than changing all administrator passwords on all of the local
> machines, I would like to remove the option of logging on to the local
> machine (if this is possible).
>
> So if someone could let me know whether that is possible, I'd greatly
> appreciate it.
>
> Thank you in advance
>
> David Lovell