Re: Deny Log on Locally to some accounts through GPO

Ravs,
Both GP settings you refer to are part of the Computer (ather than User)
Configuration - so they need to be linked to the OU where target computer
accounts reside (rather than the "Application Accounts" users)...

hth
Marcin

"Ravs" <Ravs@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:F293F580-6062-4A31-97EC-25225C82D2AD@xxxxxxxxxxxxxxxx
We have a lot of application accounts (for enabling applications to
authenticate users through AD or pulling users from AD....these accounts
do
NOT run as service....these can be treated as normal user accounts for
which
we want to disable interactive logon).

We have seen that some people who have access to these application
accounts,
logon to servers using these accounts.
We want to stop that.
In order to achieve this
we have created an OU "Application Accounts" and put all the application
accounts in this OU.
We also created a GPO named "Disable RDP Application Accounts".
I modified these settings in this GPO to achieve my goal (application
accounts should not be able to logon interactively)

GPO Setting
Deny log on locally
Deny log on through Terminal Services

In both the policies I have added the group that contains application
accounts. But with these accounts I am still able to logon locally and
terminal service in which I don't want.

Here are gpresults

C:\Documents and Settings\svc_exch>gpresult

Microsoft (R) Windows (R) XP Operating System Group Policy Result tool
v2.0
Copyright (C) Microsoft Corp. 1981-2001

Created On 11/7/2008 at 11:28:05 AM


RSOP results for ROOT\svc_exch on ROOTCLIENT1 : Logging Mode
-------------------------------------------------------------

OS Type: Microsoft Windows XP Professional
OS Configuration: Member Workstation
OS Version: 5.1.2600
Domain Name: ROOT
Domain Type: Windows 2000
Site Name: Default-First-Site-Name
Roaming Profile:
Local Profile: C:\Documents and Settings\svc_exch
Connected over a slow link?: No


COMPUTER SETTINGS
------------------
CN=ROOTCLIENT1,OU=WPA Computers,DC=root,DC=local
Last time Group Policy was applied: 11/7/2008 at 11:27:25 AM
Group Policy was applied from: rootdc1.root.local
Group Policy slow link threshold: 500 kbps

Applied Group Policy Objects
-----------------------------
WiFi Protected Access
Default Domain Policy

The following GPOs were not applied because they were filtered out
-------------------------------------------------------------------
Local Group Policy
Filtering: Not Applied (Empty)

The computer is a part of the following security groups:
--------------------------------------------------------
BUILTIN\Administrators
Everyone
BUILTIN\Users
NT AUTHORITY\NETWORK
NT AUTHORITY\Authenticated Users
ROOTCLIENT1$
Domain Computers


USER SETTINGS
--------------
CN=svc_exch,OU=Application Accounts,DC=root,DC=local
Last time Group Policy was applied: 11/7/2008 at 11:27:28 AM
Group Policy was applied from: rootdc1.root.local
Group Policy slow link threshold: 500 kbps

Applied Group Policy Objects
-----------------------------
Default Domain Policy

The following GPOs were not applied because they were filtered out
-------------------------------------------------------------------
Disable RDP Application Accounts
Filtering: Not Applied (Empty)

Local Group Policy
Filtering: Not Applied (Empty)

The user is a part of the following security groups:
----------------------------------------------------
Domain Users
Everyone
BUILTIN\Users
NT AUTHORITY\INTERACTIVE
NT AUTHORITY\Authenticated Users
LOCAL

If you notice under User Settings

" The following GPOs were not applied because they were filtered out
-------------------------------------------------------------------
Disable RDP Application Accounts
Filtering: Not Applied (Empty)"

Why is this happening. The GPO has both the policies defined with the
account added.
Under GPO security filtering also I have the account added.

Am I doing something incorrect? or It cannot be achieved.

Any Help will be appreciated

Thanks
Ravs




.

Relevant Pages

  • Re: Disable Web Access to Specific Workstations
    ... ill-advised to assign permissions to individual User or Computer accounts ... application of Group Policy will be unnecessarily ... you are correct in that the GPO setting I mentioned will not meet ... manufacturing MACHINES in that OU. ...
    (microsoft.public.windowsxp.network_web)
  • Re: Administrator restricted - Control Panel Missing
    ... If you did not specifically set up Group Policy to restrict access to ... The command net users will display user accounts and net user username will ... type of administrator. ... the control panel was missing. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Remote desktop connection and Group Policy
    ... accounts and client computer accounts are in another OU), ... GPO, with the "Replace" option. ... 260370 - How to Apply Group Policy Objects to Terminal Services ... I am running Win2k Server with Win XP ...
    (microsoft.public.win2000.termserv.apps)
  • Re: Group Policy Restrict All Drives
    ... If this is a stand-alone outside of domains, then local group policy ... always applies equally to all accounts. ... If this is being applied from AD based GPO then where you have ... I enabled Restrict All Drives in Group Policy in User Config. ...
    (microsoft.public.windows.server.security)
  • Re: Deny Log on Locally to some accounts through GPO
    ... - specify target user accounts as part of the individual GP settings (which ... We also created a GPO named "Disable RDP Application Accounts". ... Microsoft Windows XP Operating System Group Policy Result tool ...
    (microsoft.public.windows.server.active_directory)
Loading