I want to disable the local users accounts on the machines that are in the domain? i tried to deactivate it from "Configuration \ Windows Settings \ Security Settings \ Local Policies \ User Rights Assignment" but doesn't seem to be working\; I still can logon with a local account.


You can't do it directly from AD, but you can script and distribute via GPO.

This is a script that should do something like what you want, but BEWARE: this script as written disables everything that isn't Administrator or ASPNET. Modify and test before deploying.


You can do it directly from AD.

In the Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment you can find a following option: Allow log on locally.

Enable this policy and enter following account on the list: MyDomain\Authenticated Users and BUILTIN\Administrator (the latter will keep you able to login using built-in administrative account).

This way, only domain-authenticated users will be able to log-on locally (that is, perform interactive logon using logon screen).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.