I currently have a user DOMAINJOINER (located in the WIN7Support OU) which I use to deploy Windows 7 machines. This user can Create and Delete Computer Objects in the WIN7Computers OU, that's about it as far as access is concerned but he's also in Domain Users group. When the new Windows 7 computers boot (via custom image) they use DOMAINJOINER credentials to join the domain. When the computers join the domain they're added to the WIN7Computers OU (this is set in the custom image).
The WIN7Computers OU will hold all the Windows 7 machines.
In one of our GPOs I have a setting that does the following:
Deny Log on as a batch job: domain\DOMAINJOINER Deny log on locally: domain\DOMAINJOINER Deny log on through terminal services: domain\DOMAINJOINER
unfortunately this GPO can only be linked to the WIN7Computers Ou and not the WIN7Support OU where user DOMAINJOINER resides.
My question is, how can I deny DOMAINJOINER from logging on interactively to any computer in the domain yet allow the custom image to continue to use DOMAINJOINER credentials to allow computers to join the domain?