Limit user authentication by IP with PowerShell

Question

After 2 days searching on the internet cannot find a way to limit user authentication by IP range.

I have 2 rodc(A and B) and a RWDC. I have user1 in my RWDC active directory. I want to specify a user to RODC A, but both clients in both RODC can login to windows with user1.

Is there any way to limit user authentication by IP using PowerShell.

You should do this at a firewall level. If they cannot perform authentication, they cannot login. — Vasili Syrakis, Feb 20 '14 at 09:51
@Vasili Syrakis:i want to deny authenticate some user with ip addess.how can i do this? — KF2, Feb 20 '14 at 11:07
You block their IP address from all of your AD servers, or all LDAP protocols — Vasili Syrakis, Feb 20 '14 at 11:49

score 1 · Accepted Answer · answered Feb 20 '14 at 20:55

To agree with @Vasili Syrakis, how you are describing your problem, you have to do this with firewalls, or routing on your managed switch.

AD is designed for authentication of users. All it does is verify that the user exists, is a member of the appropriate groups, passwords match, is not disabled, and that's it. AD does no validation based on IP address, and is not capable, or designed for doing that.

You have to change the way you are thinking. Don't think about trying to limit user authentication, let AD do it's job and authenticate the user. You have to think about it in terms of limiting access to the resource.

How you limit access to the resource really depends on what the resource is. If you want to limit it at the Server level (i.e. don't allow anyone from 192.168.1.xxx subnet get to me), then you have to have a firewall or switch that manages access control. Firewalls and access control lists are designed to do this. They won't let the user even reach the resource, and so they won't even get the chance to authenticate with AD.

If it is specific computers (not necessarily IP addresses) that you want to stop people from logging into, then you do that with a combination of AD Groups and Group Policy See: Deny and Allow Logons with Group Policy

exactly i have two groups.group A and group B.i want the cilent with ip range 192.168.1.1/24 just can login to windows with group A and can not login with group B.i find this software:http://www.isdecisions.com/products/userlock/.this bliock access to specific group by ip range.dose it make changes in powershell?do you have any idea? — KF2, Feb 21 '14 at 05:50
PowerShell is a scripting language, and you don't really make changes to it. That software probably will do what you want, and if it does, you should get it. You can probably do the same things in PowerShell, but it would take time to do it. — HAL9256, Feb 21 '14 at 17:04

Limit user authentication by IP with PowerShell

1 Answers1