Abstract: A broadcast or multicast message from a network station is forwarded only to stations in the same virtual broadcast domain (VBD) as the sending station. In some embodiments, a VBD is virtual network (VLAN) or a workgroup (a group of stations, possibly within a VLAN). A membership of a network station in a VBD is determined based on the user who logged on to the station. When the station is first powered up, it is bound to a "default" VBD. When a user logs on, the VBD(s) assigned to the user are determined, and the user's station is switched to the VBD(s). When the user logs off, the user's station is returned to the default VBD.