Guest qq Posted September 24, 2007 Posted September 24, 2007 Hi All, I have 20 users, who can use 5 computers. I want to put these uses to one user group, and put these 5 computers to a computer group. Then I want to assign the users group just only can use the computer which I put in the computer group. Could anybody know how to do it? I use windows 2000 server. Thanks a lot.
Guest Mathieu CHATEAU Posted September 24, 2007 Posted September 24, 2007 Re: Group users and computers on Windows 2000 server Hello, it would be easier to achieve this from the account's properties account tab "Lon On To" button -- Cordialement, Mathieu CHATEAU http://lordoftheping.blogspot.com "qq" <qq@discussions.microsoft.com> wrote in message news:FBABAAA2-3A22-4E0E-B9A0-79651418D91E@microsoft.com... > Hi All, > > I have 20 users, who can use 5 computers. I want to put these uses to one > user group, and put these 5 computers to a computer group. Then I want to > assign the users group just only can use the computer which I put in the > computer group. > > Could anybody know how to do it? I use windows 2000 server. Thanks a lot.
Guest Anthony Posted September 24, 2007 Posted September 24, 2007 Re: Group users and computers on Windows 2000 server You can use a combination of the Security Policies: "Deny log on locally" and "Allow log on locally". Remember that domain users can log on locally by default except where you deny it. You would need to Deny them to all computers except the ones you want them to use. You would create a policy; apply it to all computers; deny the policy (in the policy security tab) to the group of computers you have selected; use the policy to Deny log on locally to the user group you have created. Obviously you can come up with any logical variations of this you wish. Hope that helps, Anthony, http://www.airdesk.com "qq" <qq@discussions.microsoft.com> wrote in message news:FBABAAA2-3A22-4E0E-B9A0-79651418D91E@microsoft.com... > Hi All, > > I have 20 users, who can use 5 computers. I want to put these uses to one > user group, and put these 5 computers to a computer group. Then I want to > assign the users group just only can use the computer which I put in the > computer group. > > Could anybody know how to do it? I use windows 2000 server. Thanks a lot.
Guest qq Posted September 25, 2007 Posted September 25, 2007 Re: Group users and computers on Windows 2000 server Thank you very much for your hlep. I knew that I could setup users to logon these computers from the account's properties. If I do it, I will setup each users to use these 5 computers. It is very hard for me to do it later, when I will have more thatn 20 computers sooner. It is why I want to create a user group and a computer group, and assign the user group to use all computers in the computer group. Every time, when I have a new user or a new computer, I just create a new user or a new computer, then I add the new user or computer to their group. I will not need to setup logon to all computers from new user account properties. I appreciate if you could let me know how to do it. Thanks a lot. "Mathieu CHATEAU" wrote: > Hello, > > it would be easier to achieve this from the account's properties > account tab > "Lon On To" button > > -- > Cordialement, > Mathieu CHATEAU > http://lordoftheping.blogspot.com > > > "qq" <qq@discussions.microsoft.com> wrote in message > news:FBABAAA2-3A22-4E0E-B9A0-79651418D91E@microsoft.com... > > Hi All, > > > > I have 20 users, who can use 5 computers. I want to put these uses to one > > user group, and put these 5 computers to a computer group. Then I want to > > assign the users group just only can use the computer which I put in the > > computer group. > > > > Could anybody know how to do it? I use windows 2000 server. Thanks a lot. > >
Guest qq Posted September 25, 2007 Posted September 25, 2007 Re: Group users and computers on Windows 2000 server Thank you so much for your help. > You can use a combination of the Security Policies: "Deny log on locally" > and "Allow log on locally". Shoudl I do it on Windows 2000 server Domain Controller or on client Windows XP computer? > Remember that domain users can log on locally by default except where you > deny it. You would need to Deny them to all computers except the ones you > want them to use. > You would create a policy; apply it to all computers; deny the policy (in > the policy security tab) to the group of computers you have selected; use > the policy to Deny log on locally to the user group you have created. > Obviously you can come up with any logical variations of this you wish. > Hope that helps, I am not clear what you means. Would you please let me know what policy I shoud create and how to do it? Thanks. Could I work in Active Director Users and computers, create two new groups, one for computers and one for users, then select computers from Computers directory to move to computer group, same select users from Users directory? After create computers and users groups, then, setup group policy. Thank a lot.
Guest Anthony Posted September 25, 2007 Posted September 25, 2007 Re: Group users and computers on Windows 2000 server Well you _can_ control it in the computer's Local Security Policy, but through Group Policy you can set it for a group of users or computers. You need to work from the Group Policy Management Console. You need to work with the Windows Settings, Security Settings, Local Policies, User Rights Assignment settings. You use a computer group to control which computers the policy is applied to. You use a user group to assign or remove those rights to/from a group of people. If you are not sure or confident with this, I strongly suggest you get a Test OU, Test computer and test user to experiment, or better still set up a virtual network for testing. You can cause a lot of damage if you get these wrong. Anthony, http://www.airdesk.com "qq" <qq@discussions.microsoft.com> wrote in message news:F31A689A-EF22-45DC-8945-727A87E191B0@microsoft.com... > Thank you so much for your help. > >> You can use a combination of the Security Policies: "Deny log on locally" >> and "Allow log on locally". > > Shoudl I do it on Windows 2000 server Domain Controller or on client > Windows XP computer? > >> Remember that domain users can log on locally by default except where you >> deny it. You would need to Deny them to all computers except the ones you >> want them to use. >> You would create a policy; apply it to all computers; deny the policy (in >> the policy security tab) to the group of computers you have selected; use >> the policy to Deny log on locally to the user group you have created. >> Obviously you can come up with any logical variations of this you wish. >> Hope that helps, > > I am not clear what you means. Would you please let me know what policy I > shoud create and how to do it? Thanks. > > Could I work in Active Director Users and computers, create two new > groups, > one for computers and one for users, then select computers from Computers > directory to move to computer group, same select users from Users > directory? > After create computers and users groups, then, setup group policy. > > Thank a lot.
Guest Mathieu CHATEAU Posted September 25, 2007 Posted September 25, 2007 Re: Group users and computers on Windows 2000 server What do you want to protect from ? -- Cordialement, Mathieu CHATEAU http://lordoftheping.blogspot.com "qq" <qq@discussions.microsoft.com> wrote in message news:448A2FE2-5AD6-465D-BA26-FE23FB0460FD@microsoft.com... > Thank you very much for your hlep. I knew that I could setup users to > logon > these computers from the account's properties. If I do it, I will setup > each > users to use these 5 computers. It is very hard for me to do it later, > when I > will have more thatn 20 computers sooner. It is why I want to create a > user > group and a computer group, and assign the user group to use all computers > in > the computer group. > Every time, when I have a new user or a new computer, I just create a new > user or a new computer, then I add the new user or computer to their > group. I > will not need to setup logon to all computers from new user account > properties. > > I appreciate if you could let me know how to do it. Thanks a lot. > > "Mathieu CHATEAU" wrote: > >> Hello, >> >> it would be easier to achieve this from the account's properties >> account tab >> "Lon On To" button >> >> -- >> Cordialement, >> Mathieu CHATEAU >> http://lordoftheping.blogspot.com >> >> >> "qq" <qq@discussions.microsoft.com> wrote in message >> news:FBABAAA2-3A22-4E0E-B9A0-79651418D91E@microsoft.com... >> > Hi All, >> > >> > I have 20 users, who can use 5 computers. I want to put these uses to >> > one >> > user group, and put these 5 computers to a computer group. Then I want >> > to >> > assign the users group just only can use the computer which I put in >> > the >> > computer group. >> > >> > Could anybody know how to do it? I use windows 2000 server. Thanks a >> > lot. >> >>
Recommended Posts