Dear Dave,Joe, thanks for your kind feedback.
I am a fan of your blog and your site for going on 3 years (when I discovered DayNotes).
I'm an IT manager in a school district. I normally can work out my own problems, but the following has me confused...I am looking for the simplest way of doing the following
I want to allow specific user accounts access to specific machines. We are taking about 4 user accounts and 100 machines that I want them to access. Conversely I want my other 1200 user accounts to be able to login into any machine. However I want to be sure that the 4 user accounts are only able to login to those specific 100 machines. Currently everyone can login everywhere. What is the most simple way of doing this? Windows 2000 domain controller, the 100 machines in question are Win 98 and 2000. The rest of the machines are Win 2000.
If you have any thoughts on this I would appreciate it. All the advice I got so far involves complex script writing.
Thanks,
Joe
I am hopeful that one of my readers has an answer for Joe. I've not done Windows system administration on that scale, so I really don't know. If you're reading this and wouldn't mind sharing some Windows networking savvy, how about submitting a reply comment to this post?
Posts
4 comments:
This should be fairly easy to do, as long as you have NetBIOS running.
In Active Directory Users & Computers, select the four restricted accounts (use Ctrl-Click to select the grou), and right-click to open their properties. On the Account tab, click the Log On To... button, and then specify by name the 100 workstations to which each user should be allowed to log on.
That will restrict those 4 users to just that list of 100 computers that you input. However, it will NOT restrict the remainder of your user accounts from logging into those 100 computers.
Jon,
Thanks, I know that part...my problem is that I will need to manually type in those computer names and it will be like 400 names. Is there an alternative to typing all those names?
Thanks again,
Joe from Jersey
Actually, the procedure I suggested first would only require you to type the list of workstation names once, since you are applying that list to multiple accounts at one time. I think that is the easiest way to do it, because to script it would almost certainly require you to type in the names once anyway.
Post a Comment