Logon To Particular Pcs Only

[Sean Macdonald]

Hi everyone,

In AD Users and Computers I know it is possible to restrict users
access to specific PCs only.

My question is if it is possible to enter a wildcard or range of
entries here rather than requiring the input of each individual
computer name.

For example if I have the Pcs A1 A2 A3 B1 B2 B3 could I allow a user
access to A* (or similar)to grant him access to A1 A2 & A3?

Thanks For Any Ideas

Sean

 

[Cary Shultz [A.D. MVP]]

Sean,

One thing that you could do is to create a GPO in which you 'deny logon
locally'. You would have to create an OU and put those computer account
objects in that OU and then create the GPO. You can use group filtering -
if needed - to replace the 'Authenticated Users' security group.

Does this help you?

Cary

 

[Yevgen Lazaryev]

Hi Sean,
You may consider using Cary's method but if you want to assign logon PCs
individually by user you could do it with a script writing to a
"userWorkstations" attribute ...Below is a simple example how to do it
however it can be modified to your needs ....

strUser = InputBox("Enter user name:")
strWildcard = InputBox("Enter specific part of a wildcard:")
strRange = InputBox("Enter Range like 1-5:")
Set objUser = GetObject("LDAP://cn=" & strUser &
",cn=Users,dc=company,dc=com" )
For i = Trim(Split(strRange, "-")(0)) To Trim(Split(strRange, "-")(1))
strWorkstations = strWorkstations & strWildcard & i & ","
Next
objUser.Put "userWorkstations", strWorkstations
objUser.SetInfo

....this assumes that you manually enter user name, part of the wildcard and
the numeric range like in your example ... But you can also take the list of
computers in the domain to check against the wildcard or apply the script to
the group or OU or use it in any other way .... Hope it helps ...

"Sean Macdonald" <[email protected]> a écrit dans le message de
| Hi everyone,
|
| In AD Users and Computers I know it is possible to restrict users
| access to specific PCs only.
|
| My question is if it is possible to enter a wildcard or range of
| entries here rather than requiring the input of each individual
| computer name.
|
| For example if I have the Pcs A1 A2 A3 B1 B2 B3 could I allow a user
| access to A* (or similar)to grant him access to A1 A2 & A3?
|
| Thanks For Any Ideas
|
| Sean