Allow local DC logon to users

Good Morning

don't know if is possible.
I want to allow users to login on the DC via ssh. i need to allow local
login.
I don't want users to login at the DC console. deny interactive logon.

will you please correct me if i'm wrong ??
and point me at the right direction ??

thank you
pleite

Not sure how you would do that, but even if you could, you should NEVER
allow anyone other than a domain admin access to your dc. Granting access
via another route doesn't really provide any true protection. Find another
machine to grant what it is your users need access to.

--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup This
posting is provided "AS IS" with no warranties, and confers no rights.


"Pedro M. Leite" <pleite@cimbo.com> wrote in message
news:e8RjJ8WzJHA.4116@TK2MSFTNGP04.phx.gbl...
> Good Morning
>
> don't know if is possible.
> I want to allow users to login on the DC via ssh. i need to allow local
> login.
> I don't want users to login at the DC console. deny interactive logon.
>
> will you please correct me if i'm wrong ??
> and point me at the right direction ??
>
> thank you
> pleite

Good Afternoon

I totally agree. confinement would be the next step.
anyway, and for testing purposes, am i going the right way ??

thank you
pleite


On Tue, 05 May 2009 07:15:51 -0500, Paul Bergson [MVP-DS] wrote:

> Not sure how you would do that, but even if you could, you should NEVER
> allow anyone other than a domain admin access to your dc. Granting
> access via another route doesn't really provide any true protection.
> Find another machine to grant what it is your users need access to.

Keeping off of the DC is the only way, anything else is prone to possible
attack and failure of any type of security audit.

--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup This
posting is provided "AS IS" with no warranties, and confers no rights.


"Pedro M. Leite" <pleite@cimbo.com> wrote in message
news:%23KVJyxXzJHA.1372@TK2MSFTNGP05.phx.gbl...
> Good Afternoon
>
> I totally agree. confinement would be the next step.
> anyway, and for testing purposes, am i going the right way ??
>
> thank you
> pleite
>
>
> On Tue, 05 May 2009 07:15:51 -0500, Paul Bergson [MVP-DS] wrote:
>
>> Not sure how you would do that, but even if you could, you should NEVER
>> allow anyone other than a domain admin access to your dc. Granting
>> access via another route doesn't really provide any true protection.
>> Find another machine to grant what it is your users need access to.
>

thank you

pleite
On Tue, 05 May 2009 07:42:20 -0500, Paul Bergson [MVP-DS] wrote:

> Keeping off of the DC is the only way, anything else is prone to
> possible attack and failure of any type of security audit.