The security setting is configured for computer objects. A user will be subjected to it. The user does not need to process the policy because the computer will be doing the enforcing.
So if you know which computers you dont want the user to be able to logon to, you can either
- use group policies to enforce a list of users/groups that are allowed to logon (which will obviously not include the user in question) or
- explicitly deny logon locally
Set "Deny logon locally" and "Deny logon through Remote Desktop Services" in Group Policy as follows:
Computer Configuration -> Windows Settings -> Security -> Local Policies -> User Rights Assignment
On Windows Server 2003 and earlier, "Remote Desktop Services" is called "Terminal Services."