I have a group of users that I'm setting up as test users. I want to make it so that no one can log onto the domain with these accounts, but they need to have active exchange mailboxes since this is what I am testing. I put all the test users in the same group. Can I set a security policy that will do this?
You can't disable users/groups from local login. What you can do is remove the "Users" group from the 'local login' privilege, then add back the rest of the people.
The settings are in Group Policy, Machine Settings, Security Settings, Local Policies, User Rights, Log On Locally. Be very careful you don't lock everyone out of everything (ie, apply this to an OU (or restrict it to a group) of just one computer, then test.
There are many ways to skin this cat. Basically, you can use group policy to configure the workstation “Log on locally” setting, which controls who can log on interactively to a Windows machine, you could set the accounts "log on to," you could but these users in a gropu and then apply a deny locon locally.
Deny logon locally
Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment
There are analagous settings for terminal services as well.