Re: Client Access Rights

From: Blaze (asda_at_ssfsdf.com)
Date: 02/25/05 

Date: Fri, 25 Feb 2005 20:33:55 GMT

Thanks Guys :-)

"Kurt" <kurtl@olypen.com> wrote in message
news:111pslbo67se73c@corp.supernews.com...
>
> This would only be a problem if the users in question had domain admin
> rights. I think you've hit the solution on the head. If the OPs users are
> all domain admins, there's little hope for any kind of security..
>
>
> ..kurt
>
> "Steven L Umbach" <n9rou@nospam-comcast.net> wrote in message
> news:OQUfc5TGFHA.1456@TK2MSFTNGP09.phx.gbl...
>> You can use Group Policy to do such. For instance place a group of
> computer
>> accounts in an Organizational Unit. Then create a Group Policy for that
>> OU
>> and add the global group you want to restrict to the deny logon locally
>> or
>> deny access this computer from the network user right in computer
>> configuration/Windows settings/security settings/local policies/user
> rights.
>> Note that while this will work in general, ultimately you can not
>> restrict
> a
>> domain admin that does not want to be restricted as they always have the
>> power to undo settings that restrict them. To do such you really need to
> use
>> separate domains or better yet separate forests. You still can connect
>> forests and/or domains with trusts. --- Steve
>>
>>
>> "Blaze" <asda@ssfsdf.com> wrote in message
>> news:h0PSd.51$Fc1.1@newsfe3-gui.ntli.net...
>> > Hi
>> >
>> > How can I restrict a Domain User Group from access ing a range of
>> > client
>> > PC's.. ie Admin cannot logon to Sales Departments PC's and Visa Versa
>> >
>>
>>
>
>

Relevant Pages

  • Re: Client Access Rights
    ... > rights. ... >> You can use Group Policy to do such. ... >> and add the global group you want to restrict to the deny logon locally ... >> domain admin that does not want to be restricted as they always have the ...
    (microsoft.public.cert.exam.mcse)
  • Re: Client Access Rights
    ... This would only be a problem if the users in question had domain admin ... rights. ... > Note that while this will work in general, ultimately you can not restrict ... > separate domains or better yet separate forests. ...
    (microsoft.public.win2000.networking)
  • Re: Client Access Rights
    ... This would only be a problem if the users in question had domain admin ... rights. ... > Note that while this will work in general, ultimately you can not restrict ... > separate domains or better yet separate forests. ...
    (microsoft.public.windows.server.networking)
  • Re: Client Access Rights
    ... > rights. ... >> You can use Group Policy to do such. ... >> and add the global group you want to restrict to the deny logon locally ... >> domain admin that does not want to be restricted as they always have the ...
    (microsoft.public.windows.server.networking)
  • Re: Delegate group policy?
    ... This posting is provided "AS IS" with no warranties, and confers no rights. ... Our Desktop support team is asking to be added to the "Group Policy ... Is there a way to restrict a group to admin group policy for specific ...
    (microsoft.public.windows.group_policy)
Quantcast