Pardon if someone asked before - tried searching maybe I missed it out.
Anyways, I have to
1a) Set a domain wide policy to Deny Access to this Computer from the Network 1b) Put each computer's local "Administrator" in that policy
Where I'm stumped is that on the Domain Controller >> Group Policy Management, while changing the policies during the please Select Users and Computers phase, it only displays domain users. Can't do a scope change either - it only allows searching the local DC, the whole domain, or the forest
I did some research on Restricted Users, sure I can use that tool to overwrite users group memberships but that's about it, I can't automate adding / centrally manage each PC's local admin to the Deny Logon policy.
I'd value any ideas or alternative suggestions to this issue. Might have to explain to management or even go thorough the sticky way of simply doing this as out of the box default for new computers
