Stopping local logon

[BytesBack]

Hi people

I need to be able to stop a user from accessing their account "locally"

There are server restrictions in place IE logon hours etc, but a user has found that if they pull the network cable out of the pc it will bypass the server restrictions and logon. albeit not to the server.

This now means that they have unrestricted internet access. There has to be a way to stop this but I can't find it.

 

[58sniper]

You need a proxy server to be in place.

Pat Richard MVP

 

[tfg13]

Or, you can set the cached profile setting to 0.

Using GPMC, in the OU/Computer portion of the area that this individual is in, the setting is located at:

Computer Configuration->Windows Settings->Security Settings->Local Policies->Security Options->Interactive Logon: Number of previos logons to cache (in case Domain Controller is unavailable)=0

 

[w33mhz]

or how about manage the local machine and disable the account they are using to logon with.

 

[Davetoo]

They're using a domain account on a computer that has been physically disconnected from the domain. The setting that tfg13 is referring to allows the user to do this.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[jet042]

I agree with Pat about the proxy server. Besides keeping the users from getting around the policy, it also allows you to have a lot better control of who does what when they leave your network.