Limiting Users' Access

[edwados]

Is there a way in a WIN2000 domain to limit who logs on to certain machines? I know you can limit a user to certain workstations, but can you limit a workstation to certain domain users?

 

[mrmoneymatters]

Isn't that the same thing? You can specify what computers a user can logon to.

 

[edwados]

No it is not quite the same thing. If I have one workstation that I want only one user to be able to log onto, I will have to grant all 499 other users access to all workstations but the one I want to lock down. It is doable, but seems like quite a bit of work to accomplise my objective. My question is: Is there a way to lock down a workstation allowing only one domain user to be able to log onto it.

 

[rushdik]

Mrmoneymatters is correct it is the same thing vice-versa, Just deny all except for the one you would like to allow.

What would make you job easier is if all users are put into differnet groups, that way you would only have to lock out group not having to do it 499 time.

Its like when you setup a a firewall you start with turning everything off then only turn on what you would like to allow in. Using group will make the task a little easier to do and manage

 

[minxca]

Yes you can do it, try kixtart.

ex:
~~~~~~~~~~~~~~
if @wksta = "mypc" goto logoff endif

:logoff

$RC= Shutdown("","",0,1,0)

:end
~~~~~~~~~~~~~~~~~

Apply the login script to specific users and it will shutdown (you can do retstart or log off) "mypc" if certain users login to that PC.