Deny logon privilege to every user except one on a domain computer

[soup_or_power@yahoo.com]

Hi
I have a strange request from our office assistant. She works on a
domain computer (Windows XP) called NORTON01. The domain is managed by
a Windows 2003 server. She thinks someone is hacking into her files.
So she wants to prevent everyone (except administrator of course) from
logging into NORTON01.

I searched for "restrict windows login" and found several pages that
basically describe how to assign computers in the ADU. I can't use
that feature because all the users except the office assistant float.

Can anyone help me out here?

Thanks

 

[Paul Mckenna]

Hi,

This is just a thought, If you run GPEDIT.MSC on the PC and look at Computer
Configuration/ Windows Settings/ Security Settings / Local Policies / User
Rights Assignments and then Allow logon locally i would think you could add
her domain name there and remove the 'users' user and guest if it's there. I
*think* that would work.. You could also do it using group polices which may
be safer if it doesn't work.
Basically create a new OU and move that computer into it then create and
link a group policy to that OU which sets the Allow logon locally setting.

This may not work but it's just a thought i'd be interested to see what
other people think or if anyone has ever tried this.

Regards
Paul

"soup_or_power@yahoo.com" wrote:

> Hi
> I have a strange request from our office assistant. She works on a
> domain computer (Windows XP) called NORTON01. The domain is managed by
> a Windows 2003 server. She thinks someone is hacking into her files.
> So she wants to prevent everyone (except administrator of course) from
> logging into NORTON01.
>
> I searched for "restrict windows login" and found several pages that
> basically describe how to assign computers in the ADU. I can't use
> that feature because all the users except the office assistant float.
>
> Can anyone help me out here?
>
> Thanks
>
>