Use active directory to allow a group of users to logon using a group of computers

active-directory

Usually when I prepare a new computer to be used in our company I join it to the domain, then I go into "Users account" and then I add a domain user to the list of users allowed to connect to this computer. This worked well up until now since we never had more than one or two user per computer.

Now I want to configure a computer so it can be used by almost any domain users (in fact every users in a specific Active Directory Group).

I supposed there is a way to configure this in AD, but I've been searching on the web for the last hour and I did not find anything.

Best Answer

The standard behaviour in an AD domain is to automatically add the domain group "Domain Users" to the local group "Users" on each computer that is joined to the domain; this allows all members of "Domain Users" (which by default contains all user accounts in the domain) to log on to any computer in the domain.

If you have a non-standard setup which doesn't allow all users to log on to all computers, this can be due to two reasons: either your AD user accounts were removed from the "Domain Users" domain group, or that group is not member of the local "Users" group con your computers. You should check these two settings and fix them if they are not right.