The "Right" Way:
There is, yes (sort of), but before I tell you the way I know to do this, let me advise that the safer approach to this issue is to use group policy to force a default domain on the users - so by default, they log into the domain you dictate, and don't have to worry about the domain drop down list.
The "Disable the Domain List" way:
Anyhow, to remove the drop down list, which will force users to use the full UPN (user principal name):
- Navigate to
- Create a new
- Set the value of this
- Reboot the machine.
The logon screen will no longer show a drop-down list of domains when the machine boots up, and users will need to enter the full UPN to log on.
Obviously, as this is just a registry change, you can push it out by GPO or GPP to all your machines instead of doing it manually.
Using a Documented Bug to Hide All Domains but One:
EDIT: In response to @Massimo's comment with more explicit requirements, I found this Technet thread, which suggests the bug in this KB as a workaround.
Basically, as a result of the
Netlogon.ftl file not having the proper permissions to be opened by the
winlogon process, the list of trusted domains cannot be displayed, resulting in only the domain the machine/user belongs to being displayed.
Based on a quick test, this seems to work, in a 2003 FL forest, on an XP client (all virtualized in the lab environment on my laptop). I can't do more extensive testing at the moment, but would be really curious if someone else can and report whether it works for newer OSes or in different environments.
Using a bug like this has to be the hackiest thing I've ever done, and am morbidly curious to hear about how this fares in other environments.