0

Hi there I am having a bit of a simple task problems. We have pretty simple configured MS server 2012 in our school. The thing is we want to deny access few PCs from ONE user so our students can only access library PC with their OWN account as we want to monitor their actions.

I have one user (library_user) and this user should NOT be able to log on to three specific PCs.

One way I thought is to delete the Domain User group to specific computers and create a new group with all users EXCEPT library_user user. But there are so many users on "Domain Users" group that it would take a long time to add all users manually.

Would this be the right way to get this done? Thank you

2 Answers 2

0

The Group Policy section 'Security Settings → Local Policies → User Rights Assignment' allows you to specify which users are allowed to log in and which users aren't. Specifically, there's a parameter named 'Deny log on locally' which takes priority over the corresponding 'Allow' parameter.

You should create a group for shared accounts, then add that group to the 'Deny' list. This can be done locally (via secpol.msc) as well as globally (via AD GPO).

But there are so many users on "Domain Users" group that it would take a long time to add all users manually.

You should do it anyway, and it doesn't actually take long. Even in the regular "Users and Groups" management tool (dsa.msc), it is possible to select hundreds of users from search results and add them to a group in one shot. So you really should create a "Students" group, an "Employees" group, etc.

4
  • thanks for your comment. I understand what are you talking about. But how the "Deny log on locally" parameter will affect specific computer? I understand that I will add the user to this group, but it means that after adding this one user to deny parameter the specific user will not be able to log on on any computer right? Mar 9, 2020 at 10:07
  • No. If you change the parameter through local gpedit.msc/secpol.msc then it will only affect that specific computer you did it on. And if you change the parameter through AD GPO, then you can attach the GPO to just the specific OU that contains these computers (e.g. we have an OU per classroom)...and you can use GPO "security filtering" to limit it even more. Mar 9, 2020 at 10:48
  • (And if you use ntrights as harrymc suggests – that is also local and changes the exact same thing as the secpol.msc GUI does.) Mar 9, 2020 at 10:50
  • okay thank you for information all seems to be clear now. Do you have any idea why all options on parameter are grayed out and inactive? Mar 9, 2020 at 11:41
0

You may deny local login to one user account using the ntrights tool. This tool is available from the Windows Resource Kit, but you can download it from the Winaero website (link below).

  1. Download the ZIP archive
  2. Unblock the downloaded file
  3. Extract ntrights.exe to C:\Windows\System32
  4. Open an elevated command prompt
  5. To deny local logon right:

    ntrights -u USER-NAME +r SeDenyInteractiveLogonRight
    

To later allow the user to log on locally, execute:

ntrights -u USER-NAME -r SeDenyInteractiveLogonRight
7
  • does this deny that one specific user to all computers? I don't see in command line where username is denied to log on to specific one computer. Mar 9, 2020 at 11:25
  • I see that I need to use a key right? So in my situation my command line would be?: ntrights -u library_user +r SeDenyInteractiveLogonRight -m \\PC000213 Sorry for such a simple question I'm new to this organization Mar 9, 2020 at 11:37
  • That's indeed the syntax. It still needs testing for your environment.
    – harrymc
    Mar 9, 2020 at 11:40
  • Okay I got this, but somehow I am getting OpenPolicy error. I can confirm I run this as admin and I have full admin privilegies. Have you ever got something like this? Mar 10, 2020 at 6:48
  • Add a screenshot for the error and I'll have a look.
    – harrymc
    Mar 10, 2020 at 8:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .