2003 Question

[Ryan Miller]

I have a question regarding 2003 Enterprise.

What I would like is- when my users log on to the network they will always log on to the network. In other words, I don't want them logging on to the machine if the server is down, etc.

I created a test user with the username john.doe. With the server still online I logged on to a remote workstation.

I shut down the server and logged off of that remote workstation. I typed john.doe in the username box with the correct password and it allowed me to log in. (Even though the server was off.)

Granted, the user could not use the internet, get their files, etc..- I still don't want them logging in when the server down.

Is there a way to restrict this with group policy?

Any help would be great. I'm stumped on this one.

[valter]

Yes, enable Always wait for the network at computer startup and logon GPO located in Administrative Templates\System\Logon ... this should prevent users getting "Press CTRL-ALT-DELETE" dialog before workstation communicate with AD ...

[Ryan Miller]

Thank you.

[jondercik]

Disable cached credentials as well.

[valter]

You're very welcome

[Ryan Miller]

Silly me. I forgot to include this in my original post. Is there a way to restrict the use of Computer Management?

As in using it from Administrative Tools or right clicking on My Computer and clicking Manage.

[valter]

If the user is not administrator he/she can't use computer management anyway ... I don't think what you ask is possible to be done via GPO, but I think you might want to try MS TweakUI

[Ryan Miller]

In the policy I have added the group of users to the "users" group - which should restrict them from using Computer Management.

But adding them to that group didn't have any effect. They can't install software anymore, etc - but they still can access Computer Management.

Looked into TweakUI, but there is no setting there for it.

[valter]

But even if they can access it, they can't do anything ... what ever they try to do, they will receive Access denied ...

[jondercik]

Set the NTFS permissions on the compmgmt.msc so they dont have access.

[Ryan Miller]

They can stop system services. (to klasika.)

Is there a way to set the NTFS permissions with a log in script? And what and how do I set the permissions?