I have a group of users that I'm setting up as test users. I want to make it so that no one can log onto the domain with these accounts, but they need to have active exchange mailboxes since this is what I am testing. I put all the test users in the same group. Can I set a security policy that will do this?
You can't disable users/groups from local login. What you can do is remove the "Users" group from the 'local login' privilege, then add back the rest of the people.
The settings are in Group Policy, Machine Settings, Security Settings, Local Policies, User Rights, Log On Locally. Be very careful you don't lock everyone out of everything (ie, apply this to an OU (or restrict it to a group) of just one computer, then test.