No local logon - only to domain??

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Hi, could you tell me how you could remove the local logon option for clients in an AD domain

So they can only choose to logon to a domain.....expanding this can you make OU's, place computers in and apply a GPO so it specifies exactly what domain that those specific computers can logon to and remove local logon too??

Thanks!!
 
Bbs said:
Hi, could you tell me how you could remove the local logon option for
clients in an AD domain?
Click to expand...

Make sure they don't have any local accounts on the workstations - delete
any that were created, make sure they don't know the local administrator
credentials.
So they can only choose to logon to a domain.....expanding this can
you make OU's, place computers in and apply a GPO so it specifies
exactly what domain that those specific computers can logon to and
remove local logon too???
Click to expand...

Not sure about GPOs there, as I'm not so great with policies (yet!) but
regarding what domain they can log on to, they can only log on to the one
you joined the computer to unless you have trusts in place....
 
On Windows NT4/2000/XP clients, you can do this by simply deleting/disabling
any local machine accounts on the workstations. Since users on these
machines require either a local or domain account to access them, at that
point you are restricting them to using the domain account only.

There's no real way to do this for Windows 9x or ME clients, only NT4 or
better.
 
There is no Group Policy to disable showing the local machine during logon
to a non dc domain member. You could configure the user rights assignment
for logon locally to be only domain users which I think will still allow
local administrators to logon also.

Domain controllers actually do have a local account - the administrator
account that is used for Recovery Console and Directory Services Restore
which is kept in the local sam and can be accessed only by booting into
Directory Services Restore mode.

I know of no registry mod to do what you want. One may exist but I have
never heard of it. --- Steve

Bbs said:
So how does a Domain controller disable local users and groups and when
Click to expand...
logging onto a DC not allow you to choose the local machine SAM database,
and only its AD domain (and any other domains it trusts??)
I'm guessing if it can be done via member server promotion then it can be
Click to expand...
done manually via registry settings / group policy.
 
Back
Top