Denying domain logon to certain users on W2K workstation?

[Pat Furrie]

We have several computers on our network which attract casual users due to
their private locations in the office. We have certain domain logon
accounts that we'd like to deny any logon ability at those workstations.
When I put the accounts-in-question into a "Disallow" group on on of these
machines, and then turned off "Logon locally" permissions for that group, I
thought that might prevent (hopefully) them from logging into the domain,
but that didn't happen.

Is there a way to prevent domain users from logging into these workstations?

Pat

 

[Steven L Umbach]

That should work if it is the "effective" policy as shown in Local Security Policy
settings for those user rights. If the effective settings do not reflect what you
want, then you may have policy configured at a higher precedence level such as
domain/OU where it may need to be modified or put those computers in their own OU.
Running gpresult can help tell where a machine is receiving machine policy from. You
can also restrict users to login onto only specific domain computers in their account
properties in AD Users and Computers if you further want to restrict certain
sers. --- Steve