prevent logon to particular machines- how- where?

[school]

Sorry to reask the question, but have not had luck or
much time to explore. And apologize to the original
reply'er for having to reask.

I work at a school. The students have been sitting down
at teacher workstations (there are also student
workstations where they are allowed to logon). We have
one domain. The students are in different organizational
groups than the teachers. The machines are XP pro and
the server is server 2003. Our administrator is no
longer with the school.

How, and equally important Where, do I set the security
settings to prevent the student group "8th grade" from
logging on to the muisc teachers computer?

Is that a setting on the music teacher's computer or in
Server 2003?

THANKS!

 

[Steven L Umbach]

That may have been me.

In the teachers OU. Either first create a Group Policy Object -GPO or modify the
existing one [right click OU/properties/Group Policy/edit]. Under computer
configuration/security settings/local policies/user rights assignments remove
everyone and users from "logon locally - or allow logon locally as it may be in
W2003" and add the teachers accounts or a the group that the teachers belong to.
Alternately if the students are in their own group you could add them to the deny
logon locally user right. The teachers computers may need to be rebooted before the
policy propagates to them and it should then be reflected in their Local Security
Policy for the same user rights. --- Steve