Running Server 2012 domain. Most workstations - Win7 x64.
Have a generic AD account - itsa-guest
On the user I have only allowed it to logon to itsa-pc001
So that takes care of anyone trying to use it to logon to any other machine in the company.
I want to prevent itsa-guest from being able to access UNC shares (people have shares on workstations with everyone r/w access :()
I can create a GPO that denies this - but its a PC based GPO (deny access to this computer on the network).
I was hoping there's something that I could apply to the user instead of computers. As there are some machines that don't process group policy (linux boxes etc).