We have a company doing development for us in-house and they have access to several service accounts. The company rotates people in and out, and instead of requesting accounts the developers are using service accounts to log on to the servers.
What is the best way to lock out the ability to use that account without affecting the purpose of a service account?
Can we safely check the "Deny this user permissions to log on to any Terminal Server" tickbox in AD under Terminal Services Profile?
If we created a domain policy to prevent logging in for that OU would that be a better way to go?