Setting Machine Logon Restrictions for Multiple Users - 27 Aug 2008

Q: In Active Directory (AD), you can restrict which computers a user can log on to by clicking the Log On To button on the Account tab in the user’s properties. However, I want to set machine logon restrictions for all the members of our Sales Department group. It would take a fair amount of work to set these restrictions manually in the properties of all the individual user accounts. What’s the easiest way to set machine logon restrictions for an entire group?

A: Machine logon restrictions can’t be set in the properties of an AD group object. However, you can select multiple users at once from the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in and open their properties. Select each member of the Sales Department group while holding down the Control key, or click the first user in the list, hold down the Shift key, and then click the last user in the list. Then click the Log On To button on the Account tab and enter the DNS or NetBIOS names of the computers from which members of the Sales Department group can log on in the Logon Workstations dialog box.

—Jan De Clercq