Hi All, I want to setup all of users in a department to use all of the computer in the department. How I setup group for these users to use the computers? for example, in QA department, I have 10 computers, and I have 20 users. I want these 20 users just only use these 10 computers in the QA department, they can not use other computers in other department. Can anybody give me some idea? Thanks a lot. --qq

Hi All, I want to setup all of users in a department to use all of the computer in the department. How I setup group for these users to use the computers? for example, in QA department, I have 10 computers, and I have 20 users. I want these 20 users just only use these 10 computers in the QA department, they can not use other computers in other department. Can anybody give me some idea? Thanks a lot. --qq Group Policy - Machine Only Policy (Examples for Human Resource computers) Step 1. Split your computers into different OUs by Department Step 2. Create a GPO for each OU Your GPO should have this entry... Computer Configuration \ Windows Settings \ Local Policies \ User Rights Assignment \ Deny Log on locally Computer Configuration \ Windows Settings \ Local Policies \ User Rights Assignment \ Deny Log on as a service Computer Configuration \ Windows Settings \ Local Policies \ User Rights Assignment \ Deny Log on as a batch job Computer Configuration \ Windows Settings \ Local Policies \ User Rights Assignment \ Deny access to this computer from the network Add your all departmental security groups except the department you are working on. (Deny sales, web, marketing, manufacturing, rnd) Step 5. Test logons with HR users, test with sales, web, marketing, manufacturing, and rnd users.... You should get denied logon for all but HR... Thus, you've locked down the HR systems so that other users cannot access those systems. When could this be bad? When your boss' boss wants to get into an HR System and he's a member of every group... Multi-departmental users. So always keep Executives out of departmental users incase they wish to logon to those systems... or create departmental executive security groups in addition to security groups. Steve Kline Microsoft Certified IT Professional: Server Administrator Microsoft Certified Product Specialist Microsoft Certified Network Product Specialist This posting is "as is" without warranties and confers no rights.

Hello, a different way to the option provided by Steve Kline is to use the user account properties account tab in AD UC, here choose "log on to" button and define the compueters they are allowed to use.Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.