Logon issues with Domain Users group

  • Thread starter Thread starter Harry Devine
  • Start date Start date
H

Harry Devine

Hello all,

I am trying to come up with a scheme here where everyone belongs to certain
groups (for security purposes). I would like to, if possible, not have
anyone in the Domain Users group, but rather, their primary group would be
some other group. Now, I have in GPO all of the groups listed that I want
to allow logon access to my domain, however, when I take someone out of
Domain Users, they get an error stating the they are not allowed to login
using this logon type (something like that).

I am very new to GPO and am just starting to look into the types of settings
that I can apply, so does anyone have any insight on how I can accomplish
this? Basically, I want to allow certain groups to log in to my domain. Am
I making this too complicated?

Thanks for any help.
Harry
 
I think your basic concept is incorrect. GPO applies to OU, not groups. So if
you link a GPO to an OU, the GPO applies to that OU. If you want to filter by
groups, you can apply security permission to the GPO's properties with
appropriate group.

BR,
Denis
 
To be able to logon locally at a computer (client, workstation, server
etc.), the user's account has to have the "logon locally" right.

User accounts that are in the computer's local "Users" group acquire that
right. By default, the only Domain group that is in the computer's local
"Users" group is the group called "Domain Users". This group is added
automatically when the computer is joined to the domain.

If you don't want to have all of your users in that group, or you don't want
that group in the computer's local Users group, you need to add a different
Domain group to the computer's local "Users" group.

You can force the membership of a local group (e.g. Users) on a domain
member computer using the Computer Configurtion/Windows Settings/Security
Settings/Restricted Groups. Be aware that when a Restricted Group setting
applies to a group on a computer, any existing members of the target group
are removed and replaced by what the Restricted Group setting specifies.
 
Back
Top