Re: better way to limit users/group to logon to specific workstations?
- From: "Florian Frommherz [MVP]" <florian@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Mon, 01 Oct 2007 18:38:39 +0200
Howdie!
baileyk9 schrieb:
Is there a better way to do this:
We limit a set of user accounts to logging on to specific workstations by using the "Logon Workstations" property of each of those user accounts. Seeking advice on a more manageable solution - using GPOs, and/or restructuring our OU's for these resources if necessary.
scenario: 15-20 user accounts, and 50-60 workstations that they can log on to (10-20 per user account, but it would be OK to give them access to all 50-60 workstations, since they are at different locations and will never be able to log on to those outside their site anyway). Managing this is a mess as the list of PCs they can log on to changes (PCs are added to or removed from service).
Best thing would be, if you could group the machines in OUs and the users that access it by security groups. That way, you could easily work with Anthony's suggestion, linking a Group Policy to the machine's OU and assign the "Allow log on locally" right to the security group you created for the appropritate users:
CompConf\Security Settings\Local Policies\User Rights Assignment\
You then need to remove the "Authenticated Users" from the list. Be sure to keep an option for you and your IT guys to log on to those machines.
....and beware of the "Deny log on locally" policy. I've seen many people locking themselves out with that. Best thing is you better leave it alone and work with "Allow log on locally" as described.
cheers,
Florian
--
Microsoft MVP - Windows Server - Group Policy.
eMail: prename [at] frickelsoft [dot] net.
blog: http://www.frickelsoft.net/blog.
.
- Follow-Ups:
- Prev by Date: Re: IE7 PERSONALIZING SETTINGS WINDOW PROBLEM ON NETWORK....
- Next by Date: Re: better way to limit users/group to logon to specific workstati
- Previous by thread: Re: better way to limit users/group to logon to specific workstati
- Next by thread: Re: better way to limit users/group to logon to specific workstati
- Index(es):
Relevant Pages
|
