0

I've been looking for a method in domain network to only prevent "local users account(clients local user)" log on ( but "domain users account" must still could be log on in clients)

I try to do this with "deny log on locally" policy through group policy management but there is no group for "local users account" however we can add "domain users" group to this "deny log on locally" policy and then domain users can't log on in workstation, Is there such group for "local users" ????

additional explanation

in "Allow log on locally" policy dialog box in "default domain controller policy" in explain tab it is mentioned that this policy by default apply on following users

default on workstation & server: administrators,backup operators,users.

default on domain controller: administrators,backup operators,print operators,server operators.**

According to this defaults I think there should be a way to define such client local users group in "deny log on locally" policy but every time that I want to add any of this local users group to "deny log on locally" policy the system only identified domain group or "server local user" for example when I type "users" in the "add user & group" box in "deny log on locally" policy the system identify it as group of "server local user " and not the "client(workstation) local users" then as a result of this setting I could not even log on in my server with administrator account !

Here are some method that I try and doesn't work for me (all client was joined to domain and ping domain name & server)

  • I try to add computer-name in "default domain controller policy" in the "add user & group" box in "deny log on locally" policy and when I press check-name button it added with name of "domainname\computername$ " but doesn't any effect and still all user can log on in that computer.

  • I try to add computername\localusername in the "add user & group" box in "deny log on locally" policy but when I press check-name button it didn't even identify such client.

I know (and I did) that in the "add user & group" box must click on browse button and then object type and check computers

  • So you only want users with domain accounts to be able to log on? Quite simple... Don't create any local accounts on the machine. Windows 7 and onwards (not sure if Vista had it) has the Administrator account disabled by default. The only time you create an account is during Windows setup. If you join the machine to a domain (and you configure local groups to have domain groups in) then you could, in theory, delete the account you initially created and then ONLY your domain users can log in... – Kinnectus Oct 29 '14 at 22:35
  • tnx for responding chris,but I already have local users in my clients and I want to don't allow them log on locally from server policy or somehow except sit behind each clients and delete their local account – Shayan Star Oct 29 '14 at 22:46
  • I think that because you have local users already on the machines then a domain controller won't be able to stop them logging in. You could write an elaborate script that runs through your users via the registry, obtains their user ID and dials their account if they're not a domain account... The problem you've got is that by joining the computer to the domain you (the admin) confirm a level of trust between the client and the domain controller - that includes locally created accounts. – Kinnectus Oct 29 '14 at 22:57
  • you are right,but I still searching 4 a way without scripting :) – Shayan Star Oct 29 '14 at 23:14
  • The "deny local logon" group policy is used when you want to have a local machine user account that is active and can log in to the machine over the network but cannot log in at the console. Is that really what you want in this case? – rakslice Apr 30 '15 at 5:02

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.