Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to disable the local users accounts on the machines that are in the domain? i tried to deactivate it from "Configuration \ Windows Settings \ Security Settings \ Local Policies \ User Rights Assignment" but doesn't seem to be working\; I still can logon with a local account.

share|improve this question
up vote 5 down vote accepted

You can't do it directly from AD, but you can script and distribute via GPO.

This is a script that should do something like what you want, but BEWARE: this script as written disables everything that isn't Administrator or ASPNET. Modify and test before deploying.

share|improve this answer

You can do it directly from AD.

In the Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment you can find a following option: Allow log on locally.

Enable this policy and enter following account on the list: MyDomain\Authenticated Users and BUILTIN\Administrator (the latter will keep you able to login using built-in administrative account).

This way, only domain-authenticated users will be able to log-on locally (that is, perform interactive logon using logon screen).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.