Active Directory: Authentication

Question

I have a question:
In my organization we have a requirement for users of a certain OU. Those users should only be able to authenticate to the domain but not access its resources.
You only need to use active directory authentication to access certain web applications.

I have not found how to limit access, do you have any ideas?

Answer 1

Hi，@Gonzalo Secco

As Thameur said above if the requirement is that these users cannot log in to domain computers. We can just deploy a group policy :Deny logon locally and add the user to the deny scope .
For example:
Create a gpo and link it to the OU containing computers the users can't log to.
Edit the GPO as following:

Please let us know if you would like further assistance.
Best Regards,

Answer 2

Hi,

By default when you create a simple domain user, he will have only the read right on all active directory object , so he is unable to modify any object in domain.

So, you don't need perform any action to limit user access. because he don't have any access by default.

Please don't forget to mark this reply as answer if help you to fix your issue

Answer 3

Hi,

Based on my research, if you want to limit access to domain objects, you can consider use the delegation control on the domain or a OU:
Add the users to a security group , and assign the permission what you want.


If you want to limit access to the resource in from file servers or other resource, i'm afraid you have to limit the acce from the resource side (the share permission and the NTFS permission)

Best Regards,

Answer 4

One of the requirements is that these users cannot log in to domain computers. But they must be able to authenticate to the domain.
The "Log On To" option is not functional for me.

Answer 5

Hi,

You can use set a GPO to be applied on domain computers to deny logon locally this user:

deny-log-on-locally

Please don't forget to mark this reply as answer if it help you to fix your issue