Member Avatar for weasel7711

The small business which I work for uses Microsoft Windows Small Business Server 2008. Using SBS Console I can navigate to the Users and Groups tab and then to the individual user. When I click on a user's properties and then click on the Computers tab I can see access levels for each workstation on the domain. For each computer there is a drop down for the Access Level. The drop down, however only allows me to select "Standard User" or "Local Administrator." Is there a way to select something similar to "No Access" for specific workstations for the users?

  • 2 Contributors
  • 2 Replies
  • 229 Views
  • 1 Month Discussion Span
  • Latest Post Latest Post by weasel7711

Dani AI

Generated

The SBS Console per-user “Computers” list only sets local role (Standard User / Local Administrator) and doesn’t provide a one-click “No access” option. Two reliable approaches are available: use the AD user “Log On To…” allow-list for interactive logons, or apply a per-workstation Group Policy that explicitly denies logon. was correct to point toward GPOs — they’re the right tool when you want to block specific machines.

To allow-only specific machines (interactive logon): open Active Directory Users and Computers on the DC, open the user’s Properties, go to the Account tab and click “Log On To…”. Choose “The following computers” and add the workstation names. This forces an allow-list: the user can only log on interactively to the listed machines. Important caveats: this controls console/RDP logons only and does not stop network access to shares or services.

To block specific workstations (recommended if you want to prevent access to a handful of machines): create a security group (for example, DenyLogon_Wrksts), add the users, then create a GPO linked to the OU that contains the target workstation(s). Edit the GPO: Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → User Rights Assignment → “Deny log on locally” (add the group). If you also need to block SMB/network logons, add the group to “Deny access to this computer from the network.” Test first on one machine, avoid adding Administrators or service accounts, then run gpupdate /force and confirm with gpresult /r or rsop.msc. Check the Security event log (failed logon events, e.g. 4625) to verify policy is applied.

Troubleshooting notes: Deny overrides Allow, cached credentials can allow logon when the DC is unreachable, and share/NTFS permissions are the correct way to block file/resource access. Use a test account and single test workstation before broad rollout.

Recommended Answers

All 2 Replies

Member Avatar for ajlenau

That would need to be set under group policy, on the DC...I think the editor is called GPMC in server 2008.

Member Avatar for weasel7711

Thank you.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.