Samba should provide the ability to set allowed workstations when using the tdbsam backend and adding or editing users via pdbedit and/or the net utility.
Created attachment 1778 [details] Patch to let pdbedit modify SAM workstations attribute This patch against pdbedit.c from 3.0.21c is a hack that adds a -W (or --workstations) option to pdbedit for changing the workstations SAM attribute in tdbsam. It works, but (1) it doesn't allow for setting the workstations attribute when an account is first created, and (2) I broke the model for bit flag assignments at the top of the source file by using an oddball value for BIT_WORKSTATIONS. I'm embarrassed to say that I couldn't get the hack to work after using something more appropriate, like 0x20000000.
This is implemented as "net sam set workstation" since a while now. Closing as fixed.