Differences

This shows you the differences between two versions of the page.

--- software:microsoft:windows:activedirectory [2022/04/06 03:57] – [Computer login] superwizard
+++ software:microsoft:windows:activedirectory [2024/03/02 22:28] (current) – [Viewing the active Directory with ADSIEDIT.MSC] superwizard
@@ Line 2: / Line 2: @@
 -------------------------------------------------------------------------------------------------------------------------------------------------\\
+====== Configure Microsoft Entra hybrid join ======
+<WRAP center round box >
+Bringing your devices to Microsoft Entra ID maximizes user productivity through single sign-on (SSO) across your cloud and on-premises resources. You can secure access to your resources with Conditional Access at the same time.
+https://learn.microsoft.com/en-us/entra/identity/devices/how-to-hybrid-join
+</WRAP>
 ====== Viewing the active Directory with ADSIEDIT.MSC ======
@@ Line 72: / Line 82: @@
 ====== Computer login ======
 <WRAP center round box >
+-04-05
+Deny User or Group to Sign in Locally in Windows 10
+From <https://winaero.com/deny-user-group-sign-in-locally-windows-10/>
 From: https://community.spiceworks.com/topic/216823-implications-of-removing-nt-authority-authenticated-users-user-from-users-list
@@ Line 81: / Line 98: @@
 A better way would be to do it in the security policy (secpol.msc)
-Security Settings > Local Policies > User Rights Assignments > Allow log on locally. Remove the "Users" group from this policy and add those users you want to allow to log on.
+Security Settings > Local Policies > User Rights Assignments > **Allow log on locally**.\\
+Remove the "Users" group from this policy and\\
+add those users you want to allow to log on.
 From: https://community.spiceworks.com/topic/199167-active-directory-2008-r2-control-user-login-to-computer
@@ Line 87: / Line 106: @@
 ChristopherO
 Mace
-ChristopherO Feb 15, 2012 at 6:54 AM
+ChristopherO Feb 15, 2012 at 6:54 AM \\
-You could certainly do this in 2003.  If you want to be granular, you will need to update the Users group on each computer - remove Domain Users and add in the specific accounts/groups that can log into that computer.  If it's going to be the same for a large number of computers (ie, users in the Sales group can log into any computer in the Sales department) you can use Restricted Groups in Group Policy - just remember, with Restricted Groups it will remove ALL other users/groups from that local computer group and ONLY allow in what you set in the policy.
+You could certainly do this in 2003.\\
+If you want to be granular, you will need to update the Users group on each computer\\
+- remove Domain Users and add in the specific accounts/groups that can log into that computer.\\
+If it's going to be the same for a large number of computers (ie, users in the Sales group can log into any computer in the Sales department) you can use Restricted Groups in Group Policy - just remember, with Restricted Groups it will remove ALL other users/groups from that local computer group and ONLY allow in what you set in the policy.
 From: https://community.spiceworks.com/topic/338040-how-to-stop-domain-users-from-logging-into-my-pc