Deny User Login Rights on DC

[dfcrj]

Here's my layout, we are in a single 2003 domain with 4 sites. Each
site has a DC installed. We have a user in one of the sites who walks
over to the server and logs in using their username and password into
the domain. This person is a domain admin, I do not not want him to
log into the server ever. How can I deny him the right to log in on
that server only.

I've tired the following and can't get it to work on that server in
that site.
1.) Domain Controller Security Policy - Deny Local Logon - username
2.) Domain Security Policy - Deny Local Logon - username.

I just want to deny login only on that server.
Please Help..

 

[Jerold Schulman]

Here's my layout, we are in a single 2003 domain with 4 sites. Each
site has a DC installed. We have a user in one of the sites who walks
over to the server and logs in using their username and password into
the domain. This person is a domain admin, I do not not want him to
log into the server ever. How can I deny him the right to log in on
that server only.

I've tired the following and can't get it to work on that server in
that site.
1.) Domain Controller Security Policy - Deny Local Logon - username
2.) Domain Security Policy - Deny Local Logon - username.

I just want to deny login only on that server.
Please Help..

Default Domain Controller Policy.


Jerold Schulman
Windows: General MVP
JSI, Inc.
http://www.jsiinc.com

 

[Brian Desmond [MVP]]

Domain Admins can login to DCs. You can't work around this without removing
them from domain admins and delegating them authority to do what they need
to do.

--
--
Brian Desmond
Windows Server MVP
(e-mail address removed)12.il.us

Http://www.briandesmond.com

 

[Colin Nash [MVP]]

And even if you could restrict him... he could just go in and unrestrict
himself.

 

[dfcrj]

I thought that since he was given domain admin rights that it would
have an effect, but I also thought a "deny" policy would override any
"allow" policy. How can I remove him as a domain admin but given him
rights to just one site to make small changes, like reset passwords,
and maybe install updates to local pc's?
thanks

 

[Brian Desmond [MVP]]

You can use the delegation wizard in AD Users & Computers for things like
password resets.

As far as administering local PCs, I would setup a group in AD called
DesktopAdmins, or something like that, add him & other appropriate people to
it, and then use Group Policy, and set the local ADministrators group to be
restricted, add Domain Admins, DesktopAdmins, etc.

--
--
Brian Desmond
Windows Server MVP
(e-mail address removed)12.il.us

Http://www.briandesmond.com