At IU, in Active Directory, how can I prevent users from logging into a computer?

Note: The following information is intended for registered local support providers (LSPs) at Indiana University. If you are an LSP and have questions regarding the information in this document, contact LSP Services at  lsps@iu.edu ; otherwise, contact your campus Support Center.

To prevent groups of users from logging into a Windows 2000 computer in the IU Active Directory, you need to either create a new group policy or edit an existing one. For more information about group policies, see In Microsoft Active Directory, what are group policies?

To create a new group policy, or edit an existing one:

1. Click Start and select Programs. Click Administrative Tools, and then choose Active Directory Users and Computers.
   
   
2. Right-click the domain or organizational unit (OU) to which you wish to apply the group policy, and then click Properties. In the resulting dialog box, click the Group Policy tab.
   
   
3. Click New to create a new Group Policy Object (GPO), and then click Edit. To edit an existing GPO, highlight it and click Edit.
   
   
4. In the Group Policy snap-in, under "Computer Configuration", click Windows Settings, then Security Settings, then Local Policies, and then User Rights Assignment.
   
   
5. In the "Details" pane, you can specify the users to whom you want to give or deny access:
   
   
   • To specify the users to whom you want to give access, double-click the Log on locally policy.
   • To specify the users to whom you want to deny access, double-click the Deny logon locally policy.
   
   
6. Check the box next to Define these policy settings in the template: . Click the Add... button.
   
   
7. Enter one username or group name at a time (e.g., ADS\BL-SPEA-ALL or IUB\Domain Users) in the User and group names box.

Also see:

• In Microsoft Active Directory, what are group policies?
• In the IU Active Directory, how do I create groups?
• In the IU Active Directory, how do I manage groups?
• In the IU Active Directory, how are group policy conflicts handled?
• In Active Directory, to what operating systems does group policy apply?
• In Windows Active Directory, how can I assign or publish a .MSI file?
• In the IU Active Directory, how should I deploy software?