Greetings,

I have a group of computers that are members of a large domain. The default Group Policy allows any domain users to log on locally to any computers joined to the domain. I would like to allow only users that have been granted local rights in the User Accounts control panel to log on. In other words, I would like to allow users with Administrator, Power user, or User rights to log on.

When I set the "log on locally" setting to "Administrators, Powers users, Users", it still allows all users in the domain to log on. Can anyone help me?

Thanks!

-j

I'm not sure what it is you're asking exactly.

Users can login locally only if they have a local account.

Life's more painless for the brainless.

It they have a local account before that then your change wouldn't have any effect. Delete local account or deny it by policy.

May have to use rsop to try to see what they actually have in terms of rights.
Not always correct. Members of groups get all the benefits of the primary group.
I read it wrong and answer it wrong too. So get off my case you peanut.

If the computer is part of the domain, "Users" would include domain users.

Remove "domain/domain user" from the local users group on the system. This will revoke access to domain users but still give access to power users and administrators of the domain.