Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a group of users that I'm setting up as test users. I want to make it so that no one can log onto the domain with these accounts, but they need to have active exchange mailboxes since this is what I am testing. I put all the test users in the same group. Can I set a security policy that will do this?

share|improve this question
up vote 4 down vote accepted

You can't disable users/groups from local login. What you can do is remove the "Users" group from the 'local login' privilege, then add back the rest of the people.

The settings are in Group Policy, Machine Settings, Security Settings, Local Policies, User Rights, Log On Locally. Be very careful you don't lock everyone out of everything (ie, apply this to an OU (or restrict it to a group) of just one computer, then test.

share|improve this answer
That works for a single machine, but how can I apply this to all the computers in the tree? – Jeremy Hutchinson Apr 21 '10 at 14:51
Open Group Policy Management Console from the Domain Controller. There will be a Domain Policy in there, right click and edit it (or a better practice is to add another GPO and link it). Be extremely careful though, it will apply automatically to all clients within minutes of changing the values (without having to save or close the GPMC, and assuming everything is working correctly). – Chris S Apr 21 '10 at 19:01

There are many ways to skin this cat. Basically, you can use group policy to configure the workstation “Log on locally” setting, which controls who can log on interactively to a Windows machine, you could set the accounts "log on to," you could but these users in a gropu and then apply a deny locon locally.

Deny logon locally

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

There are analagous settings for terminal services as well.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.