up vote 0 down vote favorite
share [g+] share [fb]

I'm trying to lockdown a computer after a user logs in using their domain user credentials. So once the user logs in they won't be able to use the computer until they enter a separate password that only supervisors will know. I don't need a domain wide solution as I only need this for one machine.

The computer is Windows 7 x86 Enterprise.

link|improve this question
you might be able to do something with locking the desktop as a different user...%windir%\System32\rundll32.exe user32.dll,LockWorkStation is how you invoke it from the CLI, but I'm not sure if running that as a different user would require that other users unlock password or not....worth a try – aking1012 Dec 8 '10 at 18:08
It was worth a try but it only requests the password for the currently logged on user. I tested this by pasting your command into a batch file and ran the file as another user. – MHrappstead Dec 8 '10 at 20:06
feedback

2 Answers

up vote 2 down vote accepted

You could do this the other way around where the supervisor unlocks the machine and then allows the user to log in. I don't think the windows log in has support for easy two factor authentication. What you can do is encrypt the hard drive using something like truecrypt. When the system boots, it would ask for a password which the supervisor knows, and then it would boot into windows and allow the end user to log on normally.

The downside of this solution is that the machine would have to be turned off after the user is done or they would be able to log back in without the supervisor approval. That could be fixed with a scheduled task for the middle of the night though.

Hope that helps

link|improve this answer
Thats a good idea but unfortunately once the computer is turned on it remains on till the end of the day and there will be lots of different people logging onto this machine through out the day. – MHrappstead Dec 9 '10 at 20:20
feedback
up vote 1 down vote

Another, lower tech option, would be to have a locking cabinet that the keyboard and mouse would be placed in when the user was done with the system. If you disable the USB ports or lock up the machine in a security cabinet, then you have a way to limit access.

This has the advantage of allowing the system to remain on and prevents you from installing anything.

The downside is that you have to buy special furniture to support this. You might want to think about getting them a wireless keyboard and mouse if you decide to do this.

Just a thought.

link|improve this answer
I really like this solution. Simple and effective. – MHrappstead Dec 9 '10 at 20:21
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.