SOLVED Restrict domain join for users

[Dineshyadav]

Hi,
In my company any active directory user can join the machine to the domain ?. Is it same for others. I do not want to allow domain users to join the pc to the domain. how to do this ?.

 

[Maunil Mehta]

If the machine local Users group is still granted the Log on locally user right and it still has as a member Authenticated Users then any domain account can log in.

You can removed “Users” from the “Log on locally” entry in the Local Policy of each machine. We put the subset of machines in an OU in Active Directory, then added groups (Employees) to the “Log on locally” entry in the Group Policy for the OU.

Also,, You can give the required access to users according to their Support level responsibilities..

Thanks

 

[Prajwal Desai]

see if this link helps - http://social.technet.microsoft.com...rs-from-joining-workstations-to-a-domain.aspx

 

[Dineshyadav]

Yes I got this issue fixed. Thanks for all help.