Restrict Windows login to certain IPs/hosts for certain domain accounts?

Hello to all,

I'm working with a particular client who would like to use a certain
domain account with local admin rights for config and other monitoring
via BMC, but would like to restrict that account so that it can only
log on to other systems from a single IP or a small range of IPs
(i.e., the monitoring servers), so that its local admin rights are not
used/abused by others. The client has Windows 2000 and 2003 servers,
and mostly 2000 and XP workstations. The client is using Cisco
Security Agent on the servers, so if that can factor in, that would be
fine, too. Essentially, we need an account with local admin that can
do anything on those systems for the monitoring but can't mess with AD
and can't be used from other locations by other users who might know
the password (or attackers who have guessed the password).

Is this possible? Would simply restricting local logon/TS logon via
user rights be enough? Anyone have ideas that might be helpful? I'm
wide open to suggestions; the Windows guys here are pretty good, but
even they aren't sure how to approach this. Thanks for any assistance.

Sincerely,
Chris Mallow

Relevant Pages

  • Re: Domain Profiles Borked - Cant Grant Admin Rights - HELP!!!
    ... > status of their account. ... local Admin rights were given to ... > afflicted machine and give them local Admin rights, ... the SID of your users is no longer the same as it was. ...
    (microsoft.public.windowsxp.setup_deployment)
  • RE: Restrict Windows login to certain IPs/hosts for certain domain accounts?
    ... AD and then in the Properties of that account list the servers you want ... domain account with local admin rights for config and other monitoring ...
    (Focus-Microsoft)
  • RE: local admin account password
    ... Do you think if someone wanted to break the local admin account they ... more recovery console and don't think cached logins will work. ... 5)My main idea/plan is to store all the passwords on a central SQL server. ...
    (Focus-Microsoft)
  • Re: Problems installing SQL Server 2005 in two node cluster
    ... the SQL Server service account does not need to be a local admin. ... > -> Purging the setup files from the registry with the Windows Install ...
    (microsoft.public.sqlserver.clustering)
  • Re: Distribution lists
    ... Also I have found that making that account the local admin does bupkiss ... local admin rights on the sharepoint server. ... I have made the Sharepoint Central admin app pool owner of the OU I ...
    (microsoft.public.sharepoint.windowsservices)