"Chegu Tom" <> wrote in message news:%...
> Thanks guys but I know how to restrict a user to a specific machine. I want
> to BLOCK everyone but specific users from loging on to a mchine.
>
> The second solution to "Deny log on locally". Would that allow any network
> user to log on? I am a little lost with OU and GPO terminology, Will that
> allow me to block all but specific users from using a specific machine?
>
You are creating the restriciton in a specific GPO and not globally, so no, it will not affect anyone that is not in the group used in the GPO applied to that specific OU.
Here are some links on GPOs and OUs.
Create or delete a Group Policy object
http://technet.microsoft.com/en-us/l...78(WS.10).aspx
Creating and Working with GPOs: Group Policy
http://technet.microsoft.com/en-us/l...78(WS.10).aspx
However, if you are not aware of how to organize domain objects with OUs, it implies that all your user accounts are probably still in the Users Container. This container is not an OU and a GPO cannot be applied to it. You would have to first organize your objects (users, computers, etc) before attempting this.
Based on this assumption, take a look at the following I previously wrote up, however have not published yet.
================================================== ================
================================================== ================
OU Structures and Group Policy Objects (GPOs) Design Considerations and Guidelines
It's suggested and recommended to not change the Default Domain Policy.
Keep in mind, whatever you set at the domain level will flow downhill to
everything. I would suggest to design your OU structure to reflect your
organizaiton and/or departments, which will also help you create GPOs for
the OU design.
For example, for a company with more than one location/site, I would suggest
the following:
Domain
......Philly OU
...............Accounting
...............Sales
...............Marketing
...............Desktop
...............Users
...............Laptops
......Seattle OU
...............Accounting
...............Sales
...............Marketing
...............Desktops
...............Users
...............Laptops
I separated Laptops and Desktops because I have two different Windows Update
GPOs set. The Desktop Windows Update GPO I created runs at 3:00 AM, whereas
the Laptop Updates run at 3:30 PM while the users have the laptops in the
office. This design also allows me to create GPOs for the different offices,
or I can create one and link them to both offices. The design possibilities
are endless, especially if you control flow with Block Inheritance,
Loopback, WMI filtering, disabling the Computer or User portion of a GPO,
etc, however in many cases I do not use these features because trying to
support them 8 months later when there's a problem it is difficult to
remember what you had blocked, etc. Yes youcan use RSOP to look at what is
being applied, etc, but I find it easier to simply create another OU or a
child OU to have a different setting than the parent, such as the following,
where I created a GPO to lock the desktop with two different time settings.
The Desktops OU has a 30 minute setting, but I created a 15 Minute Timeout
OU directly beneath it. Because the identical setting isdifferent on the
child, it overrides the parent's setting. I can simply "look" at my OUs and
know what I have applied.
......Seattle OU
...............Accounting
...............Sales
...............Marketing
...............Desktops
.....................15 Minute Timeout OU
...............Users
...............Laptops
These are just suggestions, and you may find that it may work for you, or
not. Even in a single site, I still do it this way, because it is flexible.
You never know when the customer or your company may expand. If they do,
simply create another OU for the new location.
Here's a basic visual of how GPOs work, and how it would flow downhill.
http://www.fekay.com/supportblogs/gpoflow.jpg
Design Considerations for Organizational Unit Structure and Use of Group Policy Objects
http://technet.microsoft.com/en-us/l.../cc785903.aspx
TechNet Magazine: Group Policy
http://technet.microsoft.com/en-us/m.../cc135925.aspx
Group Policy and Advanced Group Policy Management
http://technet.microsoft.com/en-us/w...y/default.aspx
Win2k3 AD OU/GPO Design Discussion
http://www.tomshardware.com/forum/19...ign-discussion
AD Scalability and GPOs
http://technet.microsoft.com/en-us/l.../cc756101.aspx
================================================== ================
================================================== ================
--
Ace
This posting is provided "AS-IS" with no warranties or guarantees and confers no rights.
Please reply back to the newsgroup or forum for collaboration benefit among responding engineers, and to help others benefit from your resolution.
Ace Fekay, MVP, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
If you feel this is an urgent issue and require immediate assistance, please contact Microsoft PSS directly. Please check
http://support.microsoft.com for regional support phone numbers.
Similar Threads
Linear Mode
