Locking a domain pc down for one user

markwombat · 27 Oct 2007 at 10:50

Hey guys,

Another hopefully quick question about SBS2003

our accounting pc only needs to be accessed by one person, can i lock it so only one domain user can log on?

many thanks

oddjob62 · 27 Oct 2007 at 11:15

You could edit the local security policy to just allow that user (and admins maybe) "log on locally" rights.

gamesaregood · 27 Oct 2007 at 11:16

Fairly sure thats not possible mate, once its on the domain any user of it can login to any workstation...

gamesaregood · 27 Oct 2007 at 11:17

oddjob62 said:
You could edit the local security policy to just allow that user (and admins maybe) "log on locally" rights.

Would they not be logging onto the domain though and not locally?

Deathwish · 27 Oct 2007 at 15:10

Only thing I can think of is if you create a new GPO and do some stuff with restricting desktop / start menu access. Apply it to all users, then create an "undo" policy and apply it to the user who needs to have access.

oddjob62 · 27 Oct 2007 at 15:46

gamesaregood said:
Would they not be logging onto the domain though and not locally?

It's not Local vs Domain logon, it's Local vs Remote logon.
http://technet2.microsoft.com/windo...e188-4fac-ac60-9380a58b30ae1033.mspx?mfr=true

IAmATeaf · 27 Oct 2007 at 18:35

You should be able to do this this with a computer based group policy that limits local logon only to a list of specified users. Then create a new OU, move that computer to that OU and link the GPO to the OU, reboot and test.

If you don't want to create a new OU then use security filtering of the GPO to make sure it only applies to the specified computer.

aix0 · 27 Oct 2007 at 20:18

You could try removing the 'Domain Users' global security group from the local 'Users' group on the machine, that should restrict any users from logging on unless they are member of the local 'Administrators' group i.e. 'Domain Admins' (I think).

You could then add the domain user account which you want to allow to logon via this machine into the local Administrators group and that should allow them to logon. It might work, it might not, I can't test it at the moment. I can't see why it shouldn't though.

EDIT - Actually, you don't have to add the domain user into the local Administrators group (I've been drinking), just add the domain user into the local Users group (the one where you would have removed 'Domain Users' from). Should work...

aix0 · 27 Oct 2007 at 22:05

Update - Just tested that, seems to work! Although, I would have thought that there'd be an easier way to enable this.

Deathwish · 27 Oct 2007 at 23:32

Well, you learn something new everyday. It is actually quite simple

Put the Computer in question in a new Organization Unit, and apply a new GPO to it.

Edit the following section of the GPO:

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow logon locally

Add Domain Admins, Administrators etc and of course the person you want to be able to logon!

aix0 · 27 Oct 2007 at 23:33

Deathwish said:
Well, you learn something new everyday. It is actually quite simple

Put the Computer in question in a new Organization Unit, and apply a new GPO to it.

Edit the following section of the GPO:

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow logon locally

Add Domain Admins, Administrators etc and of course the person you want to be able to logon!

Does that stop users from logging onto the domain, or just locally?

Deathwish · 27 Oct 2007 at 23:40

I tested it on a domain user account (actually 2 users in different OUs) and they couldn't logon. A DA account could however logon.

Edit:
http://technet2.microsoft.com/windo...e188-4fac-ac60-9380a58b30ae1033.mspx?mfr=true

aix0 · 27 Oct 2007 at 23:48

Deathwish said:
I tested it on a domain user account (actually 2 users in different OUs) and they couldn't logon. A DA account could however logon.

Edit:
http://technet2.microsoft.com/windo...e188-4fac-ac60-9380a58b30ae1033.mspx?mfr=true

As I said before, there was probably an easier away to achieve this. The policy name is somewhat misleading though. I completely ignored 'logon locally' because I thought that's what it meant - logon... 'locally'!

Damn you Microsoft.

Deathwish · 28 Oct 2007 at 00:23

Yep, you aren't the only one! That's exactly what I thought, but I tried it and it worked

oddjob62 · 28 Oct 2007 at 00:59

which is what i said in the first place... ahh well nobody wants to listen to me