I'm implementing security restrictions for a client who would like to prevent admin accounts from logging into workstations.
For example each person has a user account and an admin account and only the user account should have access. The admin account is for troubleshooting purposes and for escalating privileges to resolve issues.
If I deny Interactive Log-on for the admin accounts, then the ability to use them for Run As is also removed. I also looked at "Allow Log on locally" and specifying only normal accounts but that means removing Administrators from Allow Log on locally which causes further issues.
My current recourse is to make a logon script that looks to see if the user is a normal account or admin account and in the latter circumstance start a logout process. Can anyone think of a better way of doing this? We are simply trying to implement least privileged access and ensure the administrators don't login with their admin accounts.