Logon Interactively

[Guest]

My focus is to deny all non computer science (CS) students from using my LABS (3) (140 - Computers + 400 CS students
My problem, our labs are open 20 hours a day, unsupervised to all Campus Students

My situation, we have been relegated to an Organization Unit
My containers are csc students and csc computers within the OU

My administrative nightmare, I have to remove domain users from users groups on the workstation and apply my container csc students users.

My method of deploying software, Ghost software., where I've attempted to lessen the administrative nightmare on my image but still have to (1) use SID and (2) have to still remove the groups sometimes because of problems.

Back to my focus, I need to make an argument with bullets why being a domain within the AD is less of an administratively nightmare.

Are their bullets I can use to cross reference being a Domain within the AD that would alleviate my administratively overload of being an OU, citing some of the above.

 

[Matjaz Ladava [MVP]]

Don't know is I follow your problem, but you can
a) Use Deny Logonlocaly security settings in GPO to prevent some users from
logging on to your workstations
b) use restricted groups security settings in GPO to prescribe your group
membership on your domain workstations.

HTH

--
Regards

Matjaz Ladava, MCSE, MCSA, MCT, MVP
Microsoft MVP - Active Directory
(e-mail address removed), (e-mail address removed)
http://ladava.com

My focus is to deny all non computer science (CS) students from using my

LABS (3) (140 - Computers + 400 CS students)

My problem, our labs are open 20 hours a day, unsupervised to all Campus Students.

My situation, we have been relegated to an Organization Unit.
My containers are csc students and csc computers within the OU.

My administrative nightmare, I have to remove domain users from users

groups on the workstation and apply my container csc students users.

My method of deploying software, Ghost software., where I've attempted to

lessen the administrative nightmare on my image but still have to (1) use
SID and (2) have to still remove the groups sometimes because of problems.

Back to my focus, I need to make an argument with bullets why being a

domain within the AD is less of an administratively nightmare.

Are their bullets I can use to cross reference being a Domain within the

AD that would alleviate my administratively overload of being an OU, citing
some of the above.