RE: Restrict users access to specific machines using GPO

Hi Mitch,

You did not specify whether you want all users to be able to log on to all
25 machines or not... but anyway you failed to mention if it is a w2003
domain ot not.

In group policies in the computer configuration node, in windows settings,
in security settings, in local policies and user right assignment you have
"Allow log on locally". You can define this policy and all the users or
groups that you want to be able to log on to that machine; apply the GPO to a
container that holds all 25 computer accounts etc.

Another thing you can do is: In Active Directory Users and Computers, in
Account Tab->Log On To button - you can specify to which computers the user
should be able to log on to. in 2003 you should be able to modify all 100
users a a batch, but it all depends whether you want specific users accessing
specific machines out of the 25 and whether you want those 100 users to be
able to access any other machines on you network.

Hope this helps.
.