Re: Disabling Interactive Logon Against Security Group

Thanks for the replies, to be honest though I was hoping to avoid this
approach which is why I wasn't quite sure of the initial reply.

Essentially this is to secure half a dozen guest accounts on domain of
50,000+ so that they may access a web app so to modify the security policies
this way is in my opinion a little drastic and why I original phrased my
question "disable interactive logon privilages against specific OU/User
Groups rather than against computers?"

I haven't had a chance yet but when I return to the office tomorrow I was
thinking of creating the accounts in the same sort of manner as I would a
service account given that other than SQL it's possible to prevent
interactive logons with DSAs.

Has anyone tried this before? I had assumed that this would have been fairly
common practice in anywhere that followed least-privilaged designs.


--
Regards,
Sam Gaw

http://www.samgaw.co.uk


"Roger Abell [MVP]" wrote:

Paul has shown you where to locate that policy.

There are however some potential issues to consider.

If you set this in a GPO then the list that is to be denied that you
provide in that GPO is the one, complete list used for that user
right setting on all machines subject to that GPO. In other words,
if this setting is being used on some machines, the value provided
in the GPO will replace what exists on those machines. If you look,
this is used in a default on XP clients for a couple/few accounts, so
those would no longer be denied after the GPO is applied if your
GPO just says to deny your CustomWebUser group.

One route to avoid this is to cause a machine local group to be
defined on each machine "DenyLocalLogin" and placed into the
machine's user right to deny interactive login. Then, you can
control the membership in this machine local group using the
restricted group capability from your GPO. Similar to the issue
with the user right, if you do not want to have your GPO take
control over the complete and total membership in the machine
local group then you can use technique outlined in this KB
http://support.microsoft.com/kb/810076




"Sam Gaw" <SamGaw@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:52FDD057-DCD7-4A21-AD50-3F3DA71CB191@xxxxxxxxxxxxxxxx
Svyatoslav,

Thanks for getting back to me so quickly; I'd thought about that myself
but
the problem is I can't actually find the policy anywhere. Any ideas?


--
Regards,
Sam Gaw

http://www.samgaw.co.uk


"S. Pidgorny <MVP>" wrote:

Add the group containing to the "Deny log on locally" policy on the
domain
level?

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

"Sam Gaw" <SamGaw@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:AFEC2F64-F0D4-42B1-A8AF-E461165911D4@xxxxxxxxxxxxxxxx
I was wondering if anybody knew of a way to disable interactive logon
privilages against specific OU/User Groups rather than against
computers?

Essentially I want to be able to provide domain accounts to users to
access
a web app published on the WAN but prevent them from accessing the
domain
via
any of our computers/interactive logon.

Any help or advice would be much appreciated.

--
Regards,
Sam Gaw

http://www.samgaw.co.uk






.

Relevant Pages

  • Re: Loopback policy enabled, seems to cause login script to run twice
    ... GPO containing it applies to, regardless of which actual GPO it is included ... the description of how Loopback processing works is NOT ... enables loopback processing appears and where the relevant computer accounts ... Sounds like you have included the setting that runs the Logon Script so high ...
    (microsoft.public.windows.group_policy)
  • RE: LDAP issues - mimesweeper for web & Active Directory
    ... It would just import members of the Internet Access Allowes ... How do you rate you GPO skill 1 to 10? ... GPO to an OU that has User objects/account as opposed the Comuter accounts. ... LDAP for the OU: ...
    (microsoft.public.windows.server.active_directory)
  • Re: Disabling Interactive Logon Against Security Group
    ... Essentially this is to secure half a dozen guest accounts on domain of ... question "disable interactive logon privilages against specific OU/User ... If you set this in a GPO then the list that is to be denied that you ... One route to avoid this is to cause a machine local group to be ...
    (microsoft.public.security)
  • Re: Basic Sec Template Design
    ... defined in a GPO linked to the domain object to impact domain accounts ... allowed to impact machines then these impact the machine local ... Have you also reviewed the security guides? ...
    (microsoft.public.windows.server.security)
  • Re: Domain password policy problems
    ... password policies within a single domain. ... Password Policy done right ... If a GPO linked at the domain level applies to all accounts and Gpos ...
    (microsoft.public.windows.group_policy)