workstation login restrictions

[Guest]

I know that AD will allow me to restrict a user access to only specified pcs
by adding the pcs to the allowed list. Is there a way that I can restrict all
unauthorized users to a specific pc. I need restrict login access to users on
a couple of desktops.

Thanks

Kevin

 

[Roger Abell]

You should take control over the setting for the Log on locally and/or
Deny log on locally User Right on all of your machines.
There is no setting to state, if a user is not one of (a, b, c, ...) then
allow logon only at machine (x, y, z ...) directly, but with use of
a domain group that controls the machines' Log on locally User Right
this is simply done.

 

[Steven L Umbach]

Sure. Configure the user right for logon locally and deny logon locally for
your needs. Keep in mind that lack of a user right/permission is an implicit
deny, deny overrides allow, and administrators are also members of the users
and everyone groups. For a couple of computers you can use Local Security
Policy - security settings/local policies/user rights. --- Steve

 

[Guest]

Thanks I will try this

Sure. Configure the user right for logon locally and deny logon locally for
your needs. Keep in mind that lack of a user right/permission is an implicit
deny, deny overrides allow, and administrators are also members of the users
and everyone groups. For a couple of computers you can use Local Security
Policy - security settings/local policies/user rights. --- Steve