security policy in domain controller

Question

how can Using group policy when putting pc to network to not allow local user access to desktop except for user join domain, and when disconnect the network allows local users to connect to the desktop??

Answer 1

Hi @Ziyad Tbeni ,

I am not aware of such a policy to configure what type of users (local / domain) are allowed to logon to a Windows Operating System based on the network configuration of the OS.

Why would you need this in the first place?
Theoretically, when your PC is connected to the corporate network, you will logon with an Active Directory (domain) User Account.
Then, when the same PC is disconnected from the corporate network, you will still be able to logon with any Active Directory (domain) User Account that was logged on previously on the PC (as the info is cached locally on the OS).

Either way, if you really need the Domain User only when connected and Local User only when not connected, you could build a PowerShell script that checks the user and network info at every logon, then based on your criteria could just perform a logoff automatically if the user is not the expected type.

I hope this helps!
BR,
George

Note: please "Accept the answer" if this helps you.

Answer 2

Yes, I mean when the PC is connected to the corporate network, you can log in using a user (domain) only and prevent the local user from logging in, and when you disconnect the PC from the corporate network, you can log in to a device using the local user.
my question is can a policy or script be used to do this?