Restrict workstation to only allow logon by one user

I have a workstation on our network that should only allow a specific user
or group of users to login there. I can restrict the user to a specific
workstation but I want to restrict a workstation to specific users.

How do I configure that?

"Chegu Tom" <noemail@yahoo.com> wrote in message news:u06pXx6vKHA.4552@TK2MSFTNGP04.phx.gbl...
>I have a workstation on our network that should only allow a specific user
> or group of users to login there. I can restrict the user to a specific
> workstation but I want to restrict a workstation to specific users.
>
> How do I configure that?
>
>


Does this help?

Restrict Users to Specific Workstations
http://help.lockergnome.com/windows2...ict482635.html

Or to deny everyone except the specific user:

Place all computers you want restricted into one OU then use GPO to "Deny log on locally" to the security group under:
Computer Configuration | Windows Settings | Security Settings | Local Policies | User Rights Assignment

Apply this policy to the computer OU.


--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and confers no rights.

Please reply back to the newsgroup or forum for collaboration benefit among responding engineers, and to help others benefit from your resolution.

Ace Fekay, MVP, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services

If you feel this is an urgent issue and require immediate assistance, please contact Microsoft PSS directly. Please check http://support.microsoft.com for regional support phone numbers.

Howdie!

Am 09.03.2010 18:09, schrieb Chegu Tom:
> I have a workstation on our network that should only allow a specific user
> or group of users to login there. I can restrict the user to a specific
> workstation but I want to restrict a workstation to specific users.

Yeah, Ace is right. I'd use the local Group Policy as far as possible.
That's the best - yet the cleanest way to do that.

Cheers,
Florian

"Florian Frommherz" <florian@LEAVETHISOUT.frickelsoft.net> wrote in message news:%23wPU9%238vKHA.4908@TK2MSFTNGP06.phx.gbl...
> Howdie!
>
> Am 09.03.2010 18:09, schrieb Chegu Tom:
>> I have a workstation on our network that should only allow a specific user
>> or group of users to login there. I can restrict the user to a specific
>> workstation but I want to restrict a workstation to specific users.
>
> Yeah, Ace is right. I'd use the local Group Policy as far as possible.
> That's the best - yet the cleanest way to do that.
>
> Cheers,
> Florian


Thanks for the plug, Florian. :-)

Ace

Thanks guys but I know how to restrict a user to a specific machine. I want
to BLOCK everyone but specific users from loging on to a mchine.

The second solution to "Deny log on locally". Would that allow any network
user to log on? I am a little lost with OU and GPO terminology, Will that
allow me to block all but specific users from using a specific machine?


"Ace Fekay [MVP-DS, MCT]" <aceman@mvps.RemoveThisPart.org> wrote in message
news:etcOVV7vKHA.1984@TK2MSFTNGP05.phx.gbl...
"Chegu Tom" <noemail@yahoo.com> wrote in message
news:u06pXx6vKHA.4552@TK2MSFTNGP04.phx.gbl...
>I have a workstation on our network that should only allow a specific user
> or group of users to login there. I can restrict the user to a specific
> workstation but I want to restrict a workstation to specific users.
>
> How do I configure that?
>
>


Does this help?

Restrict Users to Specific Workstations
http://help.lockergnome.com/windows2...ict482635.html

Or to deny everyone except the specific user:

Place all computers you want restricted into one OU then use GPO to "Deny
log on locally" to the security group under:
Computer Configuration | Windows Settings | Security Settings | Local
Policies | User Rights Assignment

Apply this policy to the computer OU.


--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Please reply back to the newsgroup or forum for collaboration benefit among
responding engineers, and to help others benefit from your resolution.

Ace Fekay, MVP, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE &
MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services

If you feel this is an urgent issue and require immediate assistance, please
contact Microsoft PSS directly. Please check http://support.microsoft.com
for regional support phone numbers.

Chegu Tom wrote:
> Thanks guys but I know how to restrict a user to a specific machine. I
> want to BLOCK everyone but specific users from loging on to a
> mchine.
> The second solution to "Deny log on locally". Would that allow any
> network user to log on? I am a little lost with OU and GPO
> terminology, Will that allow me to block all but specific users from
> using a specific machine?

Without implementing "denies", if the domain user is not a member of the
local group "users" then they won't be able to logon.
( Unless they belong to other local groups as well) Domain users are added
to the local "users" group by default when domain joined. if you change that
or better, enforce with restricted groups via group policy only the user /
groups you add will be able to logon to the workstation.

Greater restrictions may dictate greater limitations, local rights
modifications, or applying "denies" as needed.

>
>
> "Ace Fekay [MVP-DS, MCT]" <aceman@mvps.RemoveThisPart.org> wrote in
> message news:etcOVV7vKHA.1984@TK2MSFTNGP05.phx.gbl...
> "Chegu Tom" <noemail@yahoo.com> wrote in message
> news:u06pXx6vKHA.4552@TK2MSFTNGP04.phx.gbl...
>> I have a workstation on our network that should only allow a
>> specific user or group of users to login there. I can restrict the
>> user to a specific workstation but I want to restrict a workstation
>> to specific users. How do I configure that?
>>
>>
>
>
> Does this help?
>
> Restrict Users to Specific Workstations
> http://help.lockergnome.com/windows2...ict482635.html
>
> Or to deny everyone except the specific user:
>
> Place all computers you want restricted into one OU then use GPO to
> "Deny log on locally" to the security group under:
> Computer Configuration | Windows Settings | Security Settings | Local
> Policies | User Rights Assignment
>
> Apply this policy to the computer OU.

--
/kj

"Chegu Tom" <noemail@yahoo.com> wrote in message news:%23FuoY4IwKHA.4196@TK2MSFTNGP02.phx.gbl...
> Thanks guys but I know how to restrict a user to a specific machine. I want
> to BLOCK everyone but specific users from loging on to a mchine.
>
> The second solution to "Deny log on locally". Would that allow any network
> user to log on? I am a little lost with OU and GPO terminology, Will that
> allow me to block all but specific users from using a specific machine?
>



You are creating the restriciton in a specific GPO and not globally, so no, it will not affect anyone that is not in the group used in the GPO applied to that specific OU.

Here are some links on GPOs and OUs.

Create or delete a Group Policy object
http://technet.microsoft.com/en-us/l...78(WS.10).aspx

Creating and Working with GPOs: Group Policy
http://technet.microsoft.com/en-us/l...78(WS.10).aspx

However, if you are not aware of how to organize domain objects with OUs, it implies that all your user accounts are probably still in the Users Container. This container is not an OU and a GPO cannot be applied to it. You would have to first organize your objects (users, computers, etc) before attempting this.

Based on this assumption, take a look at the following I previously wrote up, however have not published yet.

==================================================================
==================================================================
OU Structures and Group Policy Objects (GPOs) Design Considerations and Guidelines

It's suggested and recommended to not change the Default Domain Policy.
Keep in mind, whatever you set at the domain level will flow downhill to
everything. I would suggest to design your OU structure to reflect your
organizaiton and/or departments, which will also help you create GPOs for
the OU design.

For example, for a company with more than one location/site, I would suggest
the following:

Domain
......Philly OU
...............Accounting
...............Sales
...............Marketing
...............Desktop
...............Users
...............Laptops
......Seattle OU
...............Accounting
...............Sales
...............Marketing
...............Desktops
...............Users
...............Laptops

I separated Laptops and Desktops because I have two different Windows Update
GPOs set. The Desktop Windows Update GPO I created runs at 3:00 AM, whereas
the Laptop Updates run at 3:30 PM while the users have the laptops in the
office. This design also allows me to create GPOs for the different offices,
or I can create one and link them to both offices. The design possibilities
are endless, especially if you control flow with Block Inheritance,
Loopback, WMI filtering, disabling the Computer or User portion of a GPO,
etc, however in many cases I do not use these features because trying to
support them 8 months later when there's a problem it is difficult to
remember what you had blocked, etc. Yes youcan use RSOP to look at what is
being applied, etc, but I find it easier to simply create another OU or a
child OU to have a different setting than the parent, such as the following,
where I created a GPO to lock the desktop with two different time settings.
The Desktops OU has a 30 minute setting, but I created a 15 Minute Timeout
OU directly beneath it. Because the identical setting isdifferent on the
child, it overrides the parent's setting. I can simply "look" at my OUs and
know what I have applied.

......Seattle OU
...............Accounting
...............Sales
...............Marketing
...............Desktops
.....................15 Minute Timeout OU
...............Users
...............Laptops

These are just suggestions, and you may find that it may work for you, or
not. Even in a single site, I still do it this way, because it is flexible.
You never know when the customer or your company may expand. If they do,
simply create another OU for the new location.

Here's a basic visual of how GPOs work, and how it would flow downhill.
http://www.fekay.com/supportblogs/gpoflow.jpg

Design Considerations for Organizational Unit Structure and Use of Group Policy Objects
http://technet.microsoft.com/en-us/l.../cc785903.aspx

TechNet Magazine: Group Policy
http://technet.microsoft.com/en-us/m.../cc135925.aspx

Group Policy and Advanced Group Policy Management
http://technet.microsoft.com/en-us/w...y/default.aspx

Win2k3 AD OU/GPO Design Discussion
http://www.tomshardware.com/forum/19...ign-discussion

AD Scalability and GPOs
http://technet.microsoft.com/en-us/l.../cc756101.aspx
==================================================================
==================================================================

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and confers no rights.

Please reply back to the newsgroup or forum for collaboration benefit among responding engineers, and to help others benefit from your resolution.

Ace Fekay, MVP, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services

If you feel this is an urgent issue and require immediate assistance, please contact Microsoft PSS directly. Please check http://support.microsoft.com for regional support phone numbers.