Restricting Interactive User Logons

Q: How can I restrict Windows users’ capability to log on interactively to Windows from the Windows console in an Active Directory (AD) environment?

A: A Windows user can start an interactive logon process by pressing the Ctrl+Alt+Del key sequence, by requesting a secondary logon session using, for example, the runas command line utility, or by starting a connection to another machine using Terminal Services or Remote Desktop. In a Windows AD environment, you can centrally control interactive logon by using logon rights or using a set of AD user account object properties.

The “Log on locally” logon right controls who can log on interactively to a Windows machine using Ctrl+Alt+Del or by starting a secondary logon session. In Windows 2000, this logon right was also required to log on using Terminal Services or Remote Desktop. In Windows Server 2003 and Win2K Service Pack 2 (SP2) and later, Terminal Services- and Remote Desktop-based interactive logons are controlled using the “Allow logon through Terminal Services” logon right. In Win2K, Microsoft also introduced the “Deny log on locally” and “Deny Logon through Terminal Services” user rights.

Another very efficient mechanism to restrict a user’s interactive logon rights is to restrict the machines to which a user can log on interactively. AD administrators can restrict to which domain machines a domain user can log on interactively by using the AD “Log On To…” user account property. You can assess this property from the Account tab of the user’s account properties (as Figure 1 shows) in the MMC AD Users and Computers snap-in. To restrict the machines a user can log on to interactively, select “The following computers” radio button. You can then add machines by typing their NetBIOS name in the Computer Name field and clicking Add. AD stores this data as a comma-separated list in the userworkstations user account AD attribute. The “Log On To…” domain user account property doesn't affect a user’s capability to log on locally to a machine using a local account.

The Account tab in the AD Users and Computers user account properties contains another feature that you can use to restrict a user’s logon behavior: the Logon Hours… button allows an AD administrator to restrict the hours a user can log on to the domain. These time restrictions apply to all logon types (not only interactive logon, but also network logon) and don't impact a user’s capability to log on locally to a machine using a local account.

The “Log On To…” and “Logon Hours…” domain user account restrictions also apply when a user starts a secondary logon session or when a user logs on using a Terminal Services or Remote Desktop connection.