Re: Windows equiv of UNIX "Restricted Users"??
- From: "Roger Abell [MVP]" <mvpNoSpam@xxxxxxx>
- Date: Mon, 19 Feb 2007 22:19:28 -0700
If as one builds out a Windows AD domain one does not spec the
allowed login usages of machines (local and net) and so one just
lets things default, then you end up pretty much with any domain
account able to access any non-DC either way (it is actually even
more loose than that).
Just because the defaults exist does not mean one should accept
them, since, after all, they are defined to be reasonably restrictive
while yet allowing for the most common scenarios to work.
If each machine as added is controlled as to the allowed local
and network logins based on its use case, then your need would
be simply filled. However, with Everyone and Users still in
the Network and Users still in the local login rights on numerous
machines, defining a domain account does grant broad access.
Under those conditions use of a machine local account can often
be the most simple solution to effect restriction.
Roger
"Arthur Dent" <hitchhikersguideto-news@xxxxxxxxx> wrote in message
news:3BA242A6-6BF5-4317-A691-D4CC36A0F72D@xxxxxxxxxxxxxxxx
Hi all,
I am wondering, is there a way, to make a user in the Active Directory,
who has perms something like a "Restricted User" in Unix?
We need to give this guy access to our network to demo some software to
him, and he is going to RDC into one of our machines. I was going to
create a domain user, and only give him logon rights to that one machine,
but in testing, realized he'd still get access to the network through all
the shares. (for now i'm going to just go with a local machine account
instead of domain, but i'm curious, conceptually)...
So i want to know if its possible to create a domain user, who despite all
the "Everyone" permissions in Windows, will be limited to have access ONLY
to what i give him explicit access to... and will NOT be given implicit
rights through the everyone group., ... there is just too much work to be
able to do it right now, to remove all the "Everyones".
I thought maybe putting him in the "Domain Guests" group would limit him,
but it didnt.
Searched on google a bunch of different ways, and could not find
anything....
Thanks in advance,
Arthur Dent.
.
- Follow-Ups:
- Re: Windows equiv of UNIX "Restricted Users"??
- From: Arthur Dent
- Re: Windows equiv of UNIX "Restricted Users"??
- Prev by Date: Security Event Log
- Next by Date: Re: Windows equiv of UNIX "Restricted Users"??
- Previous by thread: Security Event Log
- Next by thread: Re: Windows equiv of UNIX "Restricted Users"??
- Index(es):
Relevant Pages
|
