computer & User account restrictoions

[Little_Red_Frog]

Hi

could someone tell me how to restrict my computer fro letting people logging on - i want to be the only person who can log on to my administrators pc

many thanks

Alex T

[hutzmoose]

Assuming you are using NT,
Go to User Mananger
Policies
User Rights
Log on Locally
Remove all accounts you don't want to be able to log on.

Mike

Fumbling through the registy since 1998 ;o)

[Little_Red_Frog]

thanks

i am using w2k, which user accounts need access or can i remove all the options like power users and administrators

i dont want anyone being able to log on

many thanks
Alex T

[hutzmoose]

OK for Win 2K it is a little weird.
Open the MMC for Computer Management (local)
Expand Services and Applications
Right Click on WMI and hit properties
Click the Security Tab
Highlight Root
Click the security button
Add your account and remove the everyone group
I personally would add a local admin account as well as my domain account, just in case there are network problems preventing a network logon.

Let me know how this works for you.

Mike

Fumbling through the registy since 1998 ;o)

[Little_Red_Frog]

HI

works perfect

thanks

Alex T

[husker78]

There really isn't enough information here in that is this a stand alone situation or a network log on. What is the OS NT or 2000. If it is windows 2000 control panels, users and set the log on there. No user name password no log on.

[Little_Red_Frog]

The problem is partialy solved

it´s a nt domain and w2k client, everyone has a roaming profile so could log on to my pc

the goal was that none of the other domain admins or users could log on (i am also a domain admin)

there is nothing to hide on the pc but we all work on shifts and when one of the domain admins is not in the office the other domain admins uses that pc as test pc and several pcs have been &#$"~§ up because of that

now when i follow the instructions as mentioned above by HUTZMOOZE (thanks by the way) it works for restricting users but when i remove the administrators user group it will always put it back when saving

thanks

alex t

[gary0907]

Have you consideredd using local machine policies. These would be no good if you were in a w2k environment as domain group policy over-rides local, but in an NT environment it should work fine. If you run the mmc, select group policy and connect to your local machine.

In computer config, local policies, user rights

you will find the log on locally policy (as well as a lot of others)

Double click the policy and remove the necessary groups (like all users, etc...) and put your domain account in there.

Be careful.....

[Little_Red_Frog]

HI Gary,

the domain policy seems to overide the local policy as the effective rights do not change when removing the groups

and we will be going to all w2k domain in a couple of weeks

but many thanks anyway

Alex T

[webjunkiemcse]

Local policies are only in effect on the local machine, when it connects to the network these local policies are overwritten by the domain level policies that take effect when you log on to the domain.

This is how these policies are designed to work, the local policies are not considered when the machine is a member of a domain

Derek Schauland
MCSE on Windows 2000